CVE-2012-1165
Published: 15 March 2012
The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250.
Notes
| Author | Note |
|---|---|
| jdstrand | patch assumes 22144 is also applied Cryptographic Message Syntax was added in 0.9.8h |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
openssl Launchpad, Ubuntu, Debian |
hardy |
Not vulnerable
(0.9.8g-4ubuntu3.15)
|
| lucid |
Released
(0.9.8k-7ubuntu8.10)
|
|
| maverick |
Ignored
(end of life)
|
|
| natty |
Released
(0.9.8o-5ubuntu1.4)
|
|
| oneiric |
Released
(1.0.0e-2ubuntu4.4)
|
|
| upstream |
Released
(1.0.1)
|
|
|
Patches: upstream: http://cvs.openssl.org/chngview?cn=22252 |
||
|
openssl098 Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Released
(0.9.8o-7ubuntu1.2)
|
|
| upstream |
Needs triage
|
|