CVE-2015-5333
HIGHLibreSSL < 2.3.1 - Denial of Service via ASN.1 Object Identifier Memory Leak
Title source: llmDescription
Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object identifiers in X.509 certificates.
References (4)
Core 4
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/133998/Qualys-Security-Advisory-LibreSSL-Leak-Overflow.html
Release Notes, Vendor Advisory x_refsource_confirm
http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.1-relnotes.txt
Broken Link x_refsource_misc
http://www.securityfocus.com/archive/1/archive/1/536692/100/0/threaded
Mailing List, Third Party Advisory x_refsource_misc
http://lists.opensuse.org/opensuse-updates/2015-10/msg00050.html
Scores
CVSS v3
7.5
EPSS
0.0209
EPSS Percentile
84.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-400
Status
published
Products (2)
openbsd/libressl
< 2.3.1
opensuse/opensuse
13.2
Published
Jan 23, 2020
Tracked Since
Feb 18, 2026