Latest OpenSSL Vulnerabilities Revealed; LibreSSL In Better Shape

The latest OpenSSL security vulnerabilities were made public today with four CVEs being addressed.

The OpenSSL issues were discovered during the security audit of the code-base, thanks to their new funding. The issues could cause a denial of service and include CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error, CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp, CVE-2015-0287 - ASN.1 structure reuse memory corruption, and CVE-2015-0289 - PKCS7 NULL pointer dereferences.

The impact though of the OpenSSL-forked LibreSSL is much more limited than today's OpenSSL issues.

More details can be found via the OpenBSD Journal and OpenSSL.org.