This update of openssl fixes a off-by-one buffer overflow in function SSL_get_shared_ciphers(). This vulnerability potentially allows remote code execution; depending on memory layout of the process.
(CVE-2007-5135)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-005 applied. 

This update contains security fixes for a number of programs.

A flaw in how OpenSSL performed Montgomery multiplications was discovered %that could allow a local attacker to reconstruct RSA private keys by examining another user's OpenSSL processes (CVE-2007-3108).

Moritz Jodeit found that OpenSSL's SSL_get_shared_ciphers() function did not correctly check the size of the buffer it was writing to. As a result, a remote attacker could exploit this to write one NULL byte past the end of the applications's cipher list buffer, which could possibly lead to a denial of service or the execution of arbitrary code (CVE-2007-5135).

Updated packages have been patched to prevent these issues.

Dr. Henson of the OpenSSL core team and Open Network Security discovered a mishandled error condition in the ASN.1 parser. By sending specially crafted packet data, a remote attacker could exploit this to trigger an infinite loop, which would render the service unusable and consume all available system memory. (CVE-2006-2937)

Certain types of public key could take disproportionate amounts of time to process. The library now limits the maximum key exponent size to avoid Denial of Service attacks. (CVE-2006-2940)

Tavis Ormandy and Will Drewry of the Google Security Team discovered a buffer overflow in the SSL_get_shared_ciphers() function. By sending specially crafted packets to applications that use this function (like Exim, MySQL, or the openssl command line tool), a remote attacker could exploit this to execute arbitrary code with the server's privileges. (CVE-2006-3738)

Tavis Ormandy and Will Drewry of the Google Security Team reported that the get_server_hello() function did not sufficiently check the client's session certificate. This could be exploited to crash clients by remote attackers sending specially crafted SSL responses.
(CVE-2006-4343).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that OpenSSL did not correctly perform Montgomery multiplications. Local attackers might be able to reconstruct RSA private keys by examining another user's OpenSSL processes.
(CVE-2007-3108)

Moritz Jodeit discovered that OpenSSL's SSL_get_shared_ciphers function did not correctly check the size of the buffer it was writing to. A remote attacker could exploit this to write one NULL byte past the end of an application's cipher list buffer, possibly leading to arbitrary code execution or a denial of service. (CVE-2007-5135).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is important security update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the SSL_get_shared_ciphers() utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer by a single byte (CVE-2007-5135). Few applications make use of this vulnerable function and generally it is used only when applications are compiled for debugging.

A number of possible side-channel attacks were discovered affecting OpenSSL. A local attacker could possibly obtain RSA private keys being used on a system. In practice these attacks would be difficult to perform outside of a lab environment. This update contains backported patches to mitigate these issues. (CVE-2007-3108)

As well, these updated packages fix the following bugs :

  - multithreaded applications could cause a segmentation     fault or deadlock when calling the random number     generator initialization (RAND_poll) in the OpenSSL     library, for a large number of threads simultaneously.

  - in certain circumstances, if an application using the     OpenSSL library reused the SSL session cache for     multiple purposes (with various parameters of the SSL     protocol), the session parameters could be mismatched.

  - a segmentation fault could occur when a corrupted pkcs12     file was being loaded using the 'openssl pkcs12 -in     [pkcs12-file]' command, where [pkcs12-file] is the     pkcs12 file.

Updated OpenSSL packages that correct a security issue and various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, and is also a full-strength general-purpose cryptography library.

A flaw was found in the SSL_get_shared_ciphers() utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer by a single byte (CVE-2007-5135). Few applications make use of this vulnerable function and generally it is used only when applications are compiled for debugging.

A number of possible side-channel attacks were discovered affecting OpenSSL. A local attacker could possibly obtain RSA private keys being used on a system. In practice these attacks would be difficult to perform outside of a lab environment. This update contains backported patches to mitigate these issues. (CVE-2007-3108)

As well, these updated packages fix the following bugs :

* multithreaded applications could cause a segmentation fault or deadlock when calling the random number generator initialization (RAND_poll) in the OpenSSL library, for a large number of threads simultaneously.

* in certain circumstances, if an application using the OpenSSL library reused the SSL session cache for multiple purposes (with various parameters of the SSL protocol), the session parameters could be mismatched.

* a segmentation fault could occur when a corrupted pkcs12 file was being loaded using the 'openssl pkcs12 -in [pkcs12-file]' command, where [pkcs12-file] is the pkcs12 file.

Users of OpenSSL should upgrade to these updated packages, which contain backported patches to resolve these issues.

Note: After installing this update, users are advised to either restart all services that use OpenSSL or restart their system.

SunOS 5.10_x86: libssl patch.
Date this patch was last updated by Sun : Apr/23/07

An off-by-one error has been identified in the SSL_get_shared_ciphers() routine in the libssl library from OpenSSL, an implementation of Secure Socket Layer cryptographic libraries and utilities. This error could allow an attacker to crash an application making use of OpenSSL's libssl library, or potentially execute arbitrary code in the security context of the user running such an application.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has openssl packages installed that are affected by multiple vulnerabilities:

  - In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances     where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection     were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other     places in the script where the file names of certificates being hashed were possibly passed to a command     executed through the shell. This script is distributed by some operating systems in a manner where it is     automatically executed. On such operating systems, an attacker could execute arbitrary commands with the     privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the     OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in     OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). (CVE-2022-2068)

  - The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat     Extension packets, which allows remote attackers to obtain sensitive information from process memory via     crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to     d1_both.c and t1_lib.c, aka the Heartbleed bug. (CVE-2014-0160)

  - OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service     (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled     error condition. (CVE-2006-2937)

  - OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial     of service (CPU consumption) via parasitic public keys with large (1) public exponent or (2) public     modulus values in X.509 certificates that require extra time to process when using RSA signature     verification. (CVE-2006-2940)

  - Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before     0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of     ciphers. (CVE-2006-3738)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1207 advisory.

    This advisory aggregates security fixes for the openssl SRPM in CIQ FIPS 8.6 Certified. It addresses 27     CVEs: CVE-2006-4343, CVE-2007-3108, CVE-2022-4304, CVE-2023-0215, CVE-2006-2940, and 22 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
29544	SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 4477)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	medium
33790	Mac OS X Multiple Vulnerabilities (Security Update 2008-005)	Nessus	MacOS X Local Security Checks	2008/8/1	2024/5/28	critical
26950	Mandrake Linux Security Advisory : openssl (MDKSA-2007:193)	Nessus	Mandriva Local Security Checks	2007/10/9	2021/1/6	critical
27933	Ubuntu 5.04 / 5.10 / 6.06 LTS : openssl vulnerabilities (USN-353-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	critical
28127	Ubuntu 6.06 LTS / 6.10 / 7.04 : openssl vulnerabilities (USN-522-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	critical
27777	Fedora 7 : openssl-0.9.8b-15.fc7 (2007-2530)	Nessus	Fedora Local Security Checks	2007/11/6	2021/1/11	high
60307	Scientific Linux Security Update : openssl on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
67058	CentOS 4 : openssl (CESA-2007:1003)	Nessus	CentOS Local Security Checks	2013/6/29	2021/1/4	medium
107877	Solaris 10 (x86) : 121230-02	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/23	critical
26209	Debian DSA-1379-1 : openssl - off-by-one error/buffer overflow	Nessus	Debian Local Security Checks	2007/10/3	2021/1/4	critical
301194	NewStart CGSL MAIN 6.06 (SP) : openssl Multiple Vulnerabilities (NS-SA-2026-0004)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/10	high
354370	Rocky Linux 8.6 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc Multiple Vulnerabilities (ciqsa-2026_1207)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high

偵測

搜尋 Plugin

medium

critical

critical

critical

critical

high

medium

medium

critical

critical

high

high