Your submission was sent successfully! Close

CVE-2011-0014

Published: 9 February 2011

ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka "OCSP stapling vulnerability."

Notes

AuthorNote
sbeattie
code/OCSP option is not present in karmic and earlier
Priority

Medium

Status

Package Release Status
openssl
Launchpad, Ubuntu, Debian
dapper Not vulnerable

hardy Not vulnerable

karmic Not vulnerable

lucid
Released (0.9.8k-7ubuntu8.6)
maverick
Released (0.9.8o-1ubuntu4.4)
upstream
Released (1.0.0d,0.9.8r)