CVE-2009-4355

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-01-14 · updated 2026-06-16
Weakness: CWE-399

Description

Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.

Affected products

OpenSSL: through 0.9.8l; 0.9.1c, 0.9.2b, 0.9.3, 0.9.3a, 0.9.4, 0.9.5 (+61)
RedHat Openssl: 0.9.6-15, 0.9.6b-3, 0.9.7a-2

References

http://cvs.openssl.org/chngview?cn=19068
http://cvs.openssl.org/chngview?cn=19069
http://cvs.openssl.org/chngview?cn=19167
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
http://marc.info/?l=bugtraq&m=127128920008563&w=2
http://secunia.com/advisories/38175
http://secunia.com/advisories/38181
http://secunia.com/advisories/38200
http://secunia.com/advisories/38761
http://secunia.com/advisories/39461

Get alerted when CVE-2009-4355 or the next vulnerability affects your stack