The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssl | Openssl | 1.0.0 (including) | 1.0.1g (including) |
| Red Hat Enterprise Linux 6 | RedHat | openssl-0:1.0.1e-16.el6_5.14 | * |
| Red Hat Enterprise Linux 7 | RedHat | openssl-1:1.0.1e-34.el7_0.3 | * |
| Red Hat Storage 2.1 | RedHat | openssl-0:1.0.1e-16.el6_5.14 | * |
| Openssl | Ubuntu | devel | * |
| Openssl | Ubuntu | precise | * |
| Openssl | Ubuntu | quantal | * |
| Openssl | Ubuntu | saucy | * |
| Openssl | Ubuntu | trusty | * |