CVE-2009-3245

Publication date 5 March 2010

Last updated 24 July 2024

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssl	10.04 LTS lucid	Fixed 0.9.8k-7ubuntu8
	9.10 karmic	Fixed 0.9.8g-16ubuntu3.3
	9.04 jaunty	Fixed 0.9.8g-15ubuntu3.6
	8.10 intrepid	Ignored end of life, was needed
	8.04 LTS hardy	Fixed 0.9.8g-4ubuntu3.11
	6.06 LTS dapper	Fixed 0.9.8a-7ubuntu0.13

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openssl	Upstream: http://cvs.openssl.org/chngview?cn=18936 Upstream: http://cvs.openssl.org/chngview?cn=19309

References

Related Ubuntu Security Notices (USN)

USN-1003-1
OpenSSL vulnerabilities
7 October 2010

Other references

https://www.cve.org/CVERecord?id=CVE-2009-3245