Description
yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allows remote attackers to cause a denial of service (crash) via a Hello packet containing a large size value, which triggers a buffer over-read in the HASHwithTransform::Update function in hash.cpp.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | mysql-dfsg-5.0 | 5.0.32-7etch5 | DSA-1478-1 |
Advisories 1
- DSA-1478-1 mysql-dfsg-5.0 - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-1478 vendor-advisory
- 29443 third-party-advisory
- 20080104 Multiple vulnerabilities in yaSSL 1.7.5 mailing-list
- 28324 third-party-advisory
- 3531 third-party-advisory
- 31681 vdb-entry
- yassl-hashwithtransformupdate-dos(39433) vdb-entry
- http://bugs.mysql.com/33814
- 27140 vdb-entry
- 28597 third-party-advisory
- ADV-2008-0560 vdb-entry
- 32222 third-party-advisory
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html
- ADV-2008-2780 vdb-entry
- USN-588-1 vendor-advisory
- MDVSA-2008:150 vendor-advisory
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216