Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssl | Openssl | 0.9.6 (including) | 0.9.6 (including) |
| Openssl | Openssl | 0.9.7 (including) | 0.9.7 (including) |
| Red Hat Linux 9 | RedHat | * | |
| Openssl | Ubuntu | dapper | * |
| Openssl | Ubuntu | devel | * |
| Openssl | Ubuntu | edgy | * |
| Openssl | Ubuntu | feisty | * |
| Openssl097 | Ubuntu | dapper | * |
| Openssl097 | Ubuntu | devel | * |
| Openssl097 | Ubuntu | edgy | * |
| Openssl097 | Ubuntu | feisty | * |