CVE-2015-0206

Publication date 8 January 2015

Last updated 24 July 2024

Ubuntu priority

Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssl	14.10 utopic	Fixed 1.0.1f-1ubuntu9.1
	14.04 LTS trusty	Fixed 1.0.1f-1ubuntu2.8
	12.04 LTS precise	Fixed 1.0.1-4ubuntu5.21
	10.04 LTS lucid	Not affected
openssl098	14.10 utopic	Not affected
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openssl	Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=04685bc949e90a877656cf5020b6d4f90a9636a6

CVE-2015-0206

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references