CVE-2015-0288 Null dereference in n/a
Attackers can cause a denial of service via a NULL pointer dereference in OpenSSL when processing invalid certificate keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-0288?
CVE-2015-0288 is a medium-severity vulnerability in Openssl Openssl, published on 19 Mar 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.
Which versions are affected by CVE-2015-0288?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2015-0288?
Upgrade to a fixed version.
Is CVE-2015-0288 being exploited?
There is no known exploitation of CVE-2015-0288 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as DEBIAN-CVE-2015-0288, GHSA-6m24-334v-vm3f, UBUNTU-CVE-2015-0288.