CVE-2012-2333
NoneCVSS
—
EPSS
27.9%
Published
May 14, 2012
CISA due date
—
The record
Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | openssl | 0 | 1.0.1c-1 |
| Debian:12 | openssl | 0 | 1.0.1c-1 |
| Debian:13 | openssl | 0 | 1.0.1c-1 |
| Debian:6.0 | openssl | 0 | 0.9.8o-4squeeze13 |
| Red Hat:enterprise_linux:5::client | openssl | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::client | openssl-debuginfo | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::client | openssl-devel | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::client | openssl-perl | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::client_workstation | openssl | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::client_workstation | openssl-debuginfo | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::client_workstation | openssl-devel | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::client_workstation | openssl-perl | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::server | openssl | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::server | openssl-debuginfo | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::server | openssl-devel | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:5::server | openssl-perl | 0 | 0:0.9.8e-22.el5_8.4 |
| Red Hat:enterprise_linux:6::client | openssl | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::client | openssl-debuginfo | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::client | openssl-devel | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::client | openssl-perl | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::client | openssl-static | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::computenode | openssl | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::computenode | openssl-debuginfo | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::computenode | openssl-devel | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::computenode | openssl-perl | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::computenode | openssl-static | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::server | openssl | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::server | openssl-debuginfo | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::server | openssl-devel | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::server | openssl-perl | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::server | openssl-static | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::workstation | openssl | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::workstation | openssl-debuginfo | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::workstation | openssl-devel | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::workstation | openssl-perl | 0 | 0:1.0.0-20.el6_2.5 |
| Red Hat:enterprise_linux:6::workstation | openssl-static | 0 | 0:1.0.0-20.el6_2.5 |
| SUSE:Linux Enterprise Desktop 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Desktop 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server 12 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Server 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server 12 SP1 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Server 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Software Development Kit 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Software Development Kit 12 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Software Development Kit 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Workstation Extension 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Workstation Extension 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Workstation Extension 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Workstation Extension 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| Ubuntu:14.04:LTS | openssl098 | 0 | 0.9.8o-7ubuntu3.2.14.04.1 |
Related vulnerabilities
- CVE-2024-13176 Issue summary: A timing side-channel which could potentially allow recovering the private… Also affects openssl
- CVE-2024-4741 Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be… Also affects openssl
- CVE-2024-9143 Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit… Also affects openssl
- CVE-2024-5535 Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty… Also affects openssl
- CVE-2024-2511 Issue summary: Some non-default TLS server configurations can cause unbounded memory… Also affects openssl
- CVE-2024-0727 Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash… Also affects openssl
- CVE-2023-5678 Issue summary: Generating excessively long X9.42 DH keys or checking excessively long… Also affects openssl
- CVE-2022-0778 The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can… Also affects openssl