Description
The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.1h-1 | — |
| Debian 13 | openssl | 1.0.1h-1 | — |
| Debian 12 | openssl | 1.0.1h-1 | — |
| Debian 8 | openssl | 1.0.1k-3+deb8u1 | DSA-3287-1 |
| Debian 7 | openssl | 1.0.1e-2+deb7u17 | DSA-3287-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openssl | 0.9.8o-4squeeze21 | DLA-247-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.15 | USN-2639-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssl +4 | 1:1.0.1e-42.ael7b_1.8 | RHSA-2015:1115 |
| RHEL 6 | openssl +3 | 1.0.1e-30.el6_6.11 | RHSA-2015:1115 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libressl | 2.5.0-1.1 | openSUSE-SU-2024:10309-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | openssl +4 | 1:1.0.1e-42.el7_1.8 | ELSA-2015-1115 |
Advisories 9
- RHSA-2015:1115 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- USN-2639-1 openssl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-247-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3287-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10309-1 libcrypto38-2.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- SSA-412672 SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7 Siemens ProductCERT · Dec 13, 2022
- ICSA-22-349-21 Siemens SCALANCE X-200RNA Switch Devices CISA ICS & IT advisories · Dec 13, 2022
- ELSA-2015-1115 Moderate: openssl security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 15, 2015
References
- DSA-3287 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10122
- http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015
- https://openssl.org/news/secadv/20150611.txt
- RHSA-2015:1115 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351
- 1032564 vdb-entry
- 20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products vendor-advisory
- openSUSE-SU-2015:1277 vendor-advisory
- 75159 vdb-entry
- USN-2639-1 vendor-advisory
- http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015
- https://github.com/openssl/openssl/commit/470990fee0182566d439ef7e82d1abf18b7085d7
- GLSA-201506-02 vendor-advisory
- https://rt.openssl.org/Ticket/Display.html?id=3286&user=guest&pass=guest
- RHSA-2016:2957 vendor-advisory
- SUSE-SU-2015:1185 vendor-advisory
- https://bto.bluecoat.com/security-advisory/sa98
- NetBSD-SA2015-008 vendor-advisory
- https://www.openssl.org/news/secadv_20150611.txt
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf