Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2009-4355
HistoryJan 14, 2010 - 7:30 p.m.

CVE-2009-4355

2010-01-1419:30:00
CWE-399
[email protected]
web.nvd.nist.gov
53
cve-2009-4355
memory leak
zlib_stateful_finish
openssl
denial of service
nvd
vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

6.5 Medium

AI Score

Confidence

High

0.204 Low

EPSS

Percentile

96.4%

JSON

Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.

Affected configurations

NVD
Node
opensslopensslRange≤0.9.8l
OR
opensslopensslMatch0.9.1c
OR
opensslopensslMatch0.9.2b
OR
opensslopensslMatch0.9.3
OR
opensslopensslMatch0.9.3a
OR
opensslopensslMatch0.9.4
OR
opensslopensslMatch0.9.5
OR
opensslopensslMatch0.9.5beta1
OR
opensslopensslMatch0.9.5beta2
OR
opensslopensslMatch0.9.5a
OR
opensslopensslMatch0.9.5abeta1
OR
opensslopensslMatch0.9.5abeta2
OR
opensslopensslMatch0.9.6
OR
opensslopensslMatch0.9.6beta1
OR
opensslopensslMatch0.9.6beta2
OR
opensslopensslMatch0.9.6beta3
OR
opensslopensslMatch0.9.6a
OR
opensslopensslMatch0.9.6abeta1
OR
opensslopensslMatch0.9.6abeta2
OR
opensslopensslMatch0.9.6abeta3
OR
opensslopensslMatch0.9.6b
OR
opensslopensslMatch0.9.6c
OR
opensslopensslMatch0.9.6d
OR
opensslopensslMatch0.9.6e
OR
opensslopensslMatch0.9.6f
OR
opensslopensslMatch0.9.6g
OR
opensslopensslMatch0.9.6h
OR
opensslopensslMatch0.9.6i
OR
opensslopensslMatch0.9.6j
OR
opensslopensslMatch0.9.6k
OR
opensslopensslMatch0.9.6l
OR
opensslopensslMatch0.9.6m
OR
opensslopensslMatch0.9.7
OR
opensslopensslMatch0.9.7beta1
OR
opensslopensslMatch0.9.7beta2
OR
opensslopensslMatch0.9.7beta3
OR
opensslopensslMatch0.9.7beta4
OR
opensslopensslMatch0.9.7beta5
OR
opensslopensslMatch0.9.7beta6
OR
opensslopensslMatch0.9.7a
OR
opensslopensslMatch0.9.7b
OR
opensslopensslMatch0.9.7c
OR
opensslopensslMatch0.9.7d
OR
opensslopensslMatch0.9.7e
OR
opensslopensslMatch0.9.7f
OR
opensslopensslMatch0.9.7g
OR
opensslopensslMatch0.9.7h
OR
opensslopensslMatch0.9.7i
OR
opensslopensslMatch0.9.7j
OR
opensslopensslMatch0.9.7k
OR
opensslopensslMatch0.9.7l
OR
opensslopensslMatch0.9.7m
OR
opensslopensslMatch0.9.8
OR
opensslopensslMatch0.9.8a
OR
opensslopensslMatch0.9.8b
OR
opensslopensslMatch0.9.8c
OR
opensslopensslMatch0.9.8d
OR
opensslopensslMatch0.9.8e
OR
opensslopensslMatch0.9.8f
OR
opensslopensslMatch0.9.8g
OR
opensslopensslMatch0.9.8h
OR
opensslopensslMatch0.9.8i
OR
opensslopensslMatch0.9.8j
OR
opensslopensslMatch0.9.8k
OR
redhatopensslMatch0.9.6-15
OR
redhatopensslMatch0.9.6b-3
OR
redhatopensslMatch0.9.7a-2
Node
opensslopensslMatch1.0.0beta1
OR
opensslopensslMatch1.0.0beta2
OR
opensslopensslMatch1.0.0beta3
OR
opensslopensslMatch1.0.0beta4

References

Related

prion 2
f5 2
openvas 54
ubuntucve 2
nvd 2
cvelist 2
nessus 37
debiancve 2
debian 2
osv 1
securityvulns 5
openssl 1
veracode 2
ubuntu 2
redhat 3
centos 2
oraclelinux 5
altlinux 4
fedora 7
cve 1
seebug 1
gentoo 2
suse 1
vmware 2
lenovo 2
prion
prion
Design/Logic Flaw
2010-01-14 19:30:00
Memory corruption
2008-07-10 17:41:00
f5
f5
SOL15405 - OpenSSL 0.9.8l vulnerability CVE-2009-4355
2014-07-10 00:00:00
K15405 : OpenSSL 0.9.8l vulnerability CVE-2009-4355
2014-07-10 00:00:00
openvas
openvas
Mandriva Update for openssl MDVSA-2010:022 (openssl)
2010-01-22 00:00:00
Mandriva Update for openssl MDVSA-2010:022 (openssl)
2010-01-22 00:00:00
Ubuntu Update for openssl vulnerability USN-884-1
2010-01-19 00:00:00
ubuntucve
ubuntucve
CVE-2009-4355
2010-01-13 00:00:00
CVE-2008-1678
2008-07-10 00:00:00
nvd
nvd
CVE-2009-4355
2010-01-14 19:30:00
CVE-2008-1678
2008-07-10 17:41:00
cvelist
cvelist
CVE-2009-4355
2010-01-14 19:00:00
CVE-2008-1678
2008-07-10 17:00:00
nessus
nessus
Mandriva Linux Security Advisory : openssl (MDVSA-2010:022)
2010-01-21 00:00:00
Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : openssl vulnerability (USN-884-1)
2010-01-14 00:00:00
SuSE 11 Security Update : OpenSSL (SAT Patch Number 1810)
2010-01-25 00:00:00
debiancve
debiancve
CVE-2009-4355
2010-01-14 19:30:00
CVE-2008-1678
2008-07-10 17:41:00
debian
debian
[SECURITY] [DSA-1970-1] New openssl packages fix denial of service
2010-01-13 18:47:58
[SECURITY] [DSA-1970-1] New openssl packages fix denial of service
2010-01-13 18:47:58
osv
osv
openssl - denial of service
2010-01-13 00:00:00
securityvulns
securityvulns
OpenSSL memory leak
2010-01-17 00:00:00
[USN-884-1] OpenSSL vulnerability
2010-01-17 00:00:00
Apache multiple DoS conditions
2008-07-12 00:00:00
openssl
openssl
Vulnerability in OpenSSL CVE-2009-4355
2010-01-13 00:00:00
veracode
veracode
Denial Of Service (DoS)
2020-04-10 00:47:06
Denial Of Service (DoS)
2020-04-10 00:33:34
ubuntu
ubuntu
OpenSSL vulnerability
2010-01-14 00:00:00
Apache vulnerabilities
2009-03-10 00:00:00
redhat
redhat
(RHSA-2010:0054) Moderate: openssl security update
2010-01-19 00:00:00
(RHSA-2009:1075) Moderate: httpd security update
2009-05-27 00:00:00
(RHSA-2010:0095) Important: rhev-hypervisor security and bug fix update
2010-02-09 00:00:00
centos
centos
openssl security update
2010-01-20 23:10:16
httpd, mod_ssl security update
2009-05-28 17:08:08
oraclelinux
oraclelinux
openssl security update
2010-01-20 00:00:00
httpd security update
2009-05-27 00:00:00
openssl-fips security update
2015-04-02 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package openssl10 version 0.9.8m-alt1
2010-02-26 00:00:00
Security fix for the ALT Linux 8 package openssl10 version 0.9.8m-alt1
2010-02-26 00:00:00
Security fix for the ALT Linux 6 package openssl10 version 0.9.8m-alt1
2010-02-26 00:00:00
fedora
fedora
[SECURITY] Fedora 13 Update: openssl-1.0.0-1.fc13
2010-04-09 03:42:47
[SECURITY] Fedora 12 Update: openssl-1.0.0a-1.fc12
2010-06-16 17:44:27
[SECURITY] Fedora 12 Update: openssl-1.0.0b-1.fc12
2010-11-21 21:57:22
cve
cve
CVE-2008-1678
2008-07-10 17:41:00
seebug
seebug
OpenSSL 'zlib'压缩内存泄漏远程拒绝服务漏洞
2008-10-16 00:00:00
gentoo
gentoo
Apache: Denial of service
2008-07-09 00:00:00
OpenSSL: Multiple vulnerabilities
2011-10-09 00:00:00
suse
suse
remote code execution in acroread
2010-01-26 16:40:23
vmware
vmware
ESXi utilities and ESX Service Console third party updates
2010-05-27 00:00:00
ESXi utilities and ESX Service Console third party updates
2010-05-27 00:00:00
lenovo
lenovo
Intel® PROSet/Wireless WiFi Software Vulnerabilities - Lenovo Support US
2018-11-13 17:10:51
Intel® PROSet/Wireless WiFi Software Vulnerabilities - US
2018-11-13 17:10:51

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

6.5 Medium

AI Score

Confidence

High

0.204 Low

EPSS

Percentile

96.4%

JSON
Related for CVE-2009-4355
prion2f52openvas54ubuntucve2nvd2cvelist2nessus37debiancve2debian2osv1securityvulns5openssl1veracode2ubuntu2redhat3centos2oraclelinux5altlinux4fedora7cve1seebug1gentoo2suse1vmware2lenovo2