Description
Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote attackers to cause a denial of service (crash) via a malformed Client Hello packet. NOTE: some of these details are obtained from third party information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 0.9.8g-10.1 | — |
| Debian 13 | openssl | 0.9.8g-10.1 | — |
| Debian 12 | openssl | 0.9.8g-10.1 | — |
| Debian 5.0 | openssl | 0.9.8g-10+lenny1 | DTSA-136-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_0_0 | 1.0.2u-6.2 | openSUSE-SU-2024:11126-1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Advisories 3
- DTSA-136-1 openssl - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11126-1 libopenssl-1_0_0-devel-1.0.2u-6.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- http://cert.fi/haavoittuvuudet/2008/advisory-openssl.html
- SSA:2008-210-08 vendor-advisory
- 30852 third-party-advisory
- FEDORA-2008-4723 vendor-advisory
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=738400
- openssl-servername-dos(42666) vdb-entry
- 30460 third-party-advisory
- 30825 third-party-advisory
- ADV-2008-1680 vdb-entry
- 1020121 vdb-entry
- USN-620-1 vendor-advisory
- 30868 third-party-advisory
- http://www.openssl.org/news/secadv_20080528.txt
- GLSA-200806-08 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=615606
- 31288 third-party-advisory
- 30405 third-party-advisory
- 29405 vdb-entry
- ADV-2008-1937 vdb-entry
- 31228 third-party-advisory
- MDVSA-2008:107 vendor-advisory
- VU#661475 third-party-advisory