Description

Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a fix for CVE-2006-3738. As of 20071012, it is unknown whether code execution is possible.

Remediation

References

CVE-2007-5135

Related Vulnerabilities

Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-12823)

WordPress Plugin Post Form-Registration Form-Profile Form for User Profiles and Content Forms for User Submissions Security Bypass (2.6.2)

WordPress Plugin Chained Quiz SQL Injection (1.0.8)

WordPress Plugin Spreadsheet (wpSS) SQL Injection (0.62)

OpenSSL Possible denial of service attack Vulnerability (CVE-2020-1971)

Severity

Medium

Classification

CVE-2007-5135

Tags

Missing Update Known Vulnerabilities