Description
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.1a-1 | — |
| Debian 13 | openssl | 1.0.1a-1 | — |
| Debian 12 | openssl | 1.0.1a-1 | — |
| Debian 6.0 | openssl | 0.9.8o-4squeeze11 | DSA-2454-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | openssl +3 | 1.0.0-20.el6_2.4 | RHSA-2012:0518 |
| RHEL 6 | openssl098e | 0.9.8e-17.el6_2.2 | RHSA-2012:0518 |
| RHEL 5 | openssl +2 | 0.9.8e-22.el5_8.3 | RHSA-2012:0518 |
| RHEL 5 | openssl097a | 0.9.7a-11.el5_8.2 | RHSA-2012:0518 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 5 | openssl +2 | 0.9.8e-7.el5_3.2 | RHSA-2012:0522 |
| RHEL 6.1 EUS | openssl +3 | 1.0.0-10.el6_1.6 | RHSA-2012:0522 |
| RHEL 6.0 EUS | openssl +3 | 1.0.0-4.el6_0.3 | RHSA-2012:0522 |
| RHEL 5.6 EUS | openssl +2 | 0.9.8e-12.el5_6.9 | RHSA-2012:0522 |
| RHEL 4 ELS | openssl +2 | 0.9.7a-43.20.el4 | RHSA-2012:0522 |
| RHEL 3 ELS | openssl +2 | 0.9.7a-33.28 | RHSA-2012:0522 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- OpenSSL - ASN1 BIO Memory Corruption EDB-18756 · dos · Apr 19, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2012:0518 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0522 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2454-1 openssl - multiple Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-403 Forbidden-1 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-403 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- SUSE-SU-2012:0623 vendor-advisory
- SUSE-SU-2012:1149 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
- SSRT101210 vendor-advisory
- FEDORA-2012-18035 vendor-advisory
- 48899 third-party-advisory
- 20120419 incorrect integer conversions in OpenSSL can result in memory corruption. mailing-list
- RHSA-2012:1308 vendor-advisory
- http://cvs.openssl.org/chngview?cn=22434
- MDVSA-2012:060 vendor-advisory
- RHSA-2012:1307 vendor-advisory
- 18756 exploit
- RHSA-2012:0518 vendor-advisory
- DSA-2454 vendor-advisory
- http://support.apple.com/kb/HT5784
- APPLE-SA-2013-06-04-1 vendor-advisory
- USN-1424-1 vendor-advisory
- 48895 third-party-advisory
- 48847 third-party-advisory
- http://cvs.openssl.org/chngview?cn=22439
- RHSA-2012:1306 vendor-advisory
- SUSE-SU-2012:0637 vendor-advisory
- RHSA-2012:0522 vendor-advisory
- FEDORA-2012-6343 vendor-advisory
- HPSBOV02793 vendor-advisory
- 57353 third-party-advisory
- 53158 vdb-entry
- HPSBUX02782 vendor-advisory
- FEDORA-2012-6395 vendor-advisory
- http://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578
- SSRT100852 vendor-advisory
- 48942 third-party-advisory
- http://www.openssl.org/news/secadv_20120419.txt
- http://cvs.openssl.org/chngview?cn=22431
- 1026957 vdb-entry
- 48999 third-party-advisory
- 81223 vdb-entry
- FEDORA-2012-6403 vendor-advisory
- https://kb.juniper.net/KB27376