CVE-2025-15467

CVE-2025-15467 OpenSSL CMS AuthEnvelopedData 解析中的栈缓冲区溢出。 漏洞 在解析 CMS AuthEnvelopedData 内容中的 AEAD 密码参数（例如 AES-GCM）时，evpciphergetasn1aeadparams 存在栈缓冲区溢出。超大的 IV 会溢出 16 字节的栈缓冲区，导致拒绝服务并可能远程执行代码。 受影响版本 分支| 受影响版本| 修复版本 ---|---|--- 3.6.x| 3.6.0| 3.6.1+ 3.5.x| 3.5.0-3.5.4| 3.5.5+ 3.4.x| 3.4.0-3.4.3| 3.4.4+...

Stack buffer overflow in CMS AuthEnvelopedData parsing in DR

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS...

Important: openssl

Issue Overview: A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax CMS message with an oversized Initialization Vector IV when parsing AuthEnvelopedData structures that use Authenticated Encryption...

CVE-2025-15467

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS...

Astra Linux – Vulnerability in OpenSSL

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData messages with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing a Denial of Service, or potentially remote code execution. When parsing CMS...