CVE-2012-2131

Publication date 24 April 2012

Last updated 24 July 2024

Ubuntu priority

Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssl	11.10 oneiric	Not affected
	11.04 natty	Fixed 0.9.8o-5ubuntu1.5
	10.04 LTS lucid	Fixed 0.9.8k-7ubuntu8.11
	8.04 LTS hardy	Fixed 0.9.8g-4ubuntu3.18
openssl098	11.10 oneiric	Fixed 0.9.8o-7ubuntu1.2
	11.04 natty	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release

Notes

mdeslaur

1.0.x not affected by CVE-2012-2131 all releases also have second patch to fix incorrect error code introduced in the fix for CVE-2012-2110

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openssl	Upstream: http://cvs.openssl.org/chngview?cn=22479 Upstream: http://cvs.openssl.org/chngview?cn=22476 Upstream: http://cvs.openssl.org/chngview?cn=22475 Upstream: http://cvs.openssl.org/chngview?cn=22474

References

Related Ubuntu Security Notices (USN)