CVE-2015-5334: libressl Out-of-bounds Write

Vulnerability summary

CVE-2015-5334 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in libressl. EPSS estimates a 3.49% chance of exploitation in the next 30 days, higher than 88.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 23-01-2020
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an incorrect fix for CVE-2014-3508.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.