Description
Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 0.9.8c-2 | — |
| Debian 13 | openssl | 0.9.8c-2 | — |
| Debian 12 | openssl | 0.9.8c-2 | — |
| Debian 3.1 | openssl | 0.9.7e-3sarge4 | DSA-1185-2 |
| Debian 3.1 | openssl096 | 0.9.6m-1sarge4 | DSA-1195-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | openssl +2 | 0.9.7a-43.14 | RHSA-2006:0695 |
| RHEL 4 | openssl096b | 0.9.6b-22.46 | RHSA-2006:0695 |
| RHEL 3 | openssl +2 | 0.9.7a-33.21 | RHSA-2006:0695 |
| RHEL 3 | openssl096b | 0.9.6b-16.46 | RHSA-2006:0695 |
| RHEL 2 | openssl +2 | 0.9.6b-46 | RHSA-2006:0695 |
| RHEL 2 | openssl095a | 0.9.5a-32 | RHSA-2006:0695 |
| RHEL 2 | openssl096 | 0.9.6-32 | RHSA-2006:0695 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 5 | rhn_solaris_bootstrap_5_0_2_3 +1 | 1-0 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 4 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0525 |
| Red Hat Network Satellite 4 | rhn_solaris_bootstrap_5_0_2_3 | 1-0 | RHSA-2008:0525 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_0_0 | 1.0.2u-6.2 | openSUSE-SU-2024:11126-1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Advisories 8
- RHSA-2006:0695 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1185-2 openssl Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1195-1 openssl096 Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11126-1 libopenssl-1_0_0-devel-1.0.2u-6.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2008:0629 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0525 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0264 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- MDKSA-2006:172 vendor-advisory
- 22212 third-party-advisory
- ADV-2006-4750 vdb-entry
- http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html
- 23915 third-party-advisory
- HPSBMA02250 vendor-advisory
- 1016943 vdb-entry
- 23038 third-party-advisory
- 2006-0054 vendor-advisory
- DSA-1195 vendor-advisory
- 23309 third-party-advisory
- http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html
- ADV-2006-4401 vdb-entry
- USN-353-1 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227
- 22116 third-party-advisory
- SSRT071304 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm
- GLSA-200612-11 vendor-advisory
- VU#547300 third-party-advisory
- 22166 third-party-advisory
- RHSA-2006:0695 vendor-advisory
- 23340 third-party-advisory
- ADV-2006-4314 vdb-entry
- 22385 third-party-advisory
- SUSE-SR:2006:024 vendor-advisory
- 22758 third-party-advisory
- 22487 third-party-advisory
- SUSE-SA:2006:058 vendor-advisory
- 22772 third-party-advisory
- SSRT071299 vendor-advisory
- 22165 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=304829
- 20060928 [SECURITY] OpenSSL 0.9.8d and 0.9.7l released mailing-list
- 23794 third-party-advisory
- SSRT090208 vendor-advisory
- 22220 third-party-advisory
- 23680 third-party-advisory
- http://openvpn.net/changelog.html
- 25889 third-party-advisory
- http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=498093&RenditionID=&poid=8881
- ADV-2006-4036 vdb-entry
- [3.9] 20061007 013: SECURITY FIX: October 7, 2006 vendor-advisory
- 30124 third-party-advisory
- 22626 third-party-advisory
- 22083 vdb-entry
- MDKSA-2006:178 vendor-advisory
- oval:org.mitre.oval:def:9370 vdb-entry signature
- ADV-2006-3869 vdb-entry
- 22544 third-party-advisory
- 22298 third-party-advisory
- 22130 third-party-advisory
- 31492 third-party-advisory
- 22284 third-party-advisory
- 24930 third-party-advisory
- RHSA-2008:0629 vendor-advisory
- GLSA-200610-11 vendor-advisory
- oval:org.mitre.oval:def:4256 vdb-entry signature
- http://issues.rpath.com/browse/RPL-613
- 26329 third-party-advisory