Description
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.
Published: 2015-06-12
Score: 5.0 Medium
EPSS: 9.6% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-247-1 openssl security update
Debian DSA Debian DSA DSA-3287-1 openssl security update
Ubuntu USN Ubuntu USN USN-2639-1 OpenSSL vulnerabilities
References
Link Providers
http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015 cve-icon cve-icon
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc cve-icon cve-icon
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694 cve-icon cve-icon
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733 cve-icon cve-icon
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160436.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160647.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html cve-icon cve-icon
http://marc.info/?l=bugtraq&m=143654156615516&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=143880121627664&w=2 cve-icon cve-icon
http://marc.info/?l=bugtraq&m=144050155601375&w=2 cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2015-1115.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2015-1197.html cve-icon cve-icon
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl cve-icon cve-icon
http://www.debian.org/security/2015/dsa-3287 cve-icon cve-icon
http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015 cve-icon cve-icon
http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015 cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html cve-icon cve-icon
http://www.securityfocus.com/bid/75157 cve-icon cve-icon
http://www.securityfocus.com/bid/91787 cve-icon cve-icon
http://www.securitytracker.com/id/1032564 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2639-1 cve-icon cve-icon
https://bto.bluecoat.com/security-advisory/sa98 cve-icon cve-icon
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf cve-icon cve-icon
https://github.com/openssl/openssl/commit/59302b600e8d5b77ef144e447bb046fd7ab72686 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05353965 cve-icon cve-icon
https://kc.mcafee.com/corporate/index?page=content&id=SB10122 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2015-1790 cve-icon
https://openssl.org/news/secadv/20150611.txt cve-icon cve-icon
https://security.gentoo.org/glsa/201506-02 cve-icon cve-icon
https://support.apple.com/kb/HT205031 cve-icon cve-icon
https://www.arista.com/en/support/advisories-notices/security-advisories/1144-security-advisory-11 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2015-1790 cve-icon
https://www.openssl.org/news/secadv_20150611.txt cve-icon cve-icon
History

No history.

Subscriptions

Openssl Openssl
Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-06T04:54:15.966Z

Reserved: 2015-02-17T00:00:00.000Z

Link: CVE-2015-1790

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2015-06-12T19:59:03.413

Modified: 2026-05-06T22:30:45.220

Link: CVE-2015-1790

cve-icon Redhat

Severity : Moderate

Publid Date: 2015-06-11T00:00:00Z

Links: CVE-2015-1790 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses