CVE-2015-0292

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 44.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-03-19 · updated 2026-06-17
Weakness: CWE-119

Description

Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.

Affected products

OpenSSL: through 0.9.8z; 1.0.0, 1.0.0a, 1.0.0b, 1.0.0c, 1.0.0d, 1.0.0e (+15)

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
http://marc.info/?l=bugtraq&m=143213830203296&w=2
http://marc.info/?l=bugtraq&m=143748090628601&w=2
http://marc.info/?l=bugtraq&m=144050155601375&w=2
http://marc.info/?l=bugtraq&m=144050297101809&w=2
http://rhn.redhat.com/errata/RHSA-2015-0715.html
http://rhn.redhat.com/errata/RHSA-2015-0716.html
http://rhn.redhat.com/errata/RHSA-2015-0752.html

Get alerted when CVE-2015-0292 or the next vulnerability affects your stack