SB2015042412 - Fedora 22 update for mingw-openssl
Published: April 24, 2015 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2015-0209)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c. A remote attacker can perform a denial of service (DoS) attack or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.
2) Input validation error (CVE-ID: CVE-2015-0293)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the SSLv2 implementation. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
3) Buffer overflow (CVE-ID: CVE-2015-0287)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.
4) Input validation error (CVE-ID: CVE-2015-0286)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the affected device does not properly perform boolean-type comparisons within the ASN1_TYPE_cmp function in crypto/asn1/a_type.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
5) NULL pointer dereference (CVE-ID: CVE-2015-0289)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the PKCS#7 implementation. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
6) NULL pointer dereference (CVE-ID: CVE-2015-0288)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the X509_to_X509_REQ function in crypto/x509/x509_req.c. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.