CVE-2008-0891

Published: 29 May 2008

Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote attackers to cause a denial of service (crash) via a malformed Client Hello packet. NOTE: some of these details are obtained from third party information.

Notes

I don't think we're compile with this option at all?

tlsext not enabled until 0.9.8g-5, so this is negligible on hardy

Status

References

• http://www.openssl.org/news/secadv_20080528.txt
• https://ubuntu.com/security/notices/USN-620-1
• https://www.cve.org/CVERecord?id=CVE-2008-0891
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/bugs/235913