CVE-2009-1378: canonical ubuntu_linux

Modified

AliasesDEBIAN-CVE-2009-1378

Published 19-05-2009Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2009-1378 is a medium (CVSS 5.0) vulnerability in canonical ubuntu_linux. EPSS estimates a 12.75% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

12.75%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2exploit-database, reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

OPENSUSE-SU-2024:11127-1 RHSA-2009:1335

Timeline

19-05-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

12.75%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 12.75% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

exploit-databasedosmultipleVerified
OpenSSL 0.9.8k/1.0.0-beta2 - DTLS Remote Memory Exhaustion Denial of Service
Maturity: poc
referenceUnverified
Exploit Reference (marc.info)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Canonical1 product

ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04

Debian1 product

openssl< 0.9.8k-1

Openssl1 product

openssl> 0.9.8, < 0.9.8m

3 vendors · 3 products

References

37 links

rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guestX Refsource CONFIRMBroken LinkThird Party Advisory
secunia.com/advisories/42724Third Party AdvisoryX Refsource SECUNIANot Applicable
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7229VDB EntrySignatureX Refsource OVALBroken LinkTool Signature
slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049Vendor AdvisoryX Refsource SLACKWAREMailing ListThird Party Advisory
secunia.com/advisories/38794Third Party AdvisoryX Refsource SECUNIANot Applicable
lists.vmware.com/pipermail/security-announce/2010/000082.htmlMailing ListX Refsource MLISTThird Party Advisory
www.exploit-db.com/exploits/8720ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2009/1377VDB EntryX Refsource VUPENPermissions RequiredThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11309VDB EntrySignatureX Refsource OVALBroken LinkTool Signature
secunia.com/advisories/35729Third Party AdvisoryX Refsource SECUNIANot Applicable

Show all 37 references

security.gentoo.org/glsa/glsa-200912-01.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.redhat.com/support/errata/RHSA-2009-1335.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
cvs.openssl.org/chngview?cn=18188X Refsource CONFIRMBroken LinkPatchVendor Advisory
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444Vendor AdvisoryX Refsource HPBroken LinkThird Party Advisory
secunia.com/advisories/38761Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/37003Third Party AdvisoryX Refsource SECUNIANot Applicable
marc.info?l=openssl-dev&m=124263491424212&w=2Mailing ListX Refsource MLISTExploitThird Party Advisory
secunia.com/advisories/36533Third Party AdvisoryX Refsource SECUNIANot Applicable
www.securitytracker.com/id?1022241VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.ubuntu.com/usn/USN-792-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
voodoo-circle.sourceforge.net/sa/sa-20091012-01.htmlX Refsource CONFIRMThird Party Advisory
www.openwall.com/lists/oss-security/2009/05/18/1Mailing ListX Refsource MLISTThird Party Advisory
launchpad.net/bugs/cve/2009-1378X Refsource MISCThird Party Advisory
www.securityfocus.com/bid/35001VDB EntryX Refsource BIDBroken LinkThird Party Advisory
secunia.com/advisories/38834Third Party AdvisoryX Refsource SECUNIANot Applicable
www.mandriva.com/security/advisories?name=MDVSA-2009:120Vendor AdvisoryX Refsource MANDRIVANot Applicable
secunia.com/advisories/35461Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/35128Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/35571Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/35416Third Party AdvisoryX Refsource SECUNIANot Applicable
sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.netX Refsource CONFIRMBroken Link
kb.bluecoat.com/index?page=content&id=SA50X Refsource CONFIRMBroken Link
marc.info?l=openssl-dev&m=124247679213944&w=2Mailing ListX Refsource MLISTPatchThird Party Advisory
secunia.com/advisories/42733Third Party AdvisoryX Refsource SECUNIANot Applicable
www.vupen.com/english/advisories/2010/0528VDB EntryX Refsource VUPENPermissions RequiredThird Party Advisory
security-tracker.debian.org/tracker/CVE-2009-1378Advisory