CVE-2008-0891

MEDIUM 4.3CVE-2008-0891 · Published 29/05/2008 · updated 16/06/2026

In short

CVE-2008-0891 is a MEDIUM (CVSS 4.3) vulnerability affecting openssl (openssl).
Chance of exploitation in the next 30 days (EPSS): 4.4%, higher than 91.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
openssl openssl	`= 0.9.8f= 0.9.8g`	No fix yet

Description

Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote attackers to cause a denial of service (crash) via a malformed Client Hello packet. NOTE: some of these details are obtained from third party information.

References

cert.fi/haavoittuvuudet/2008/advisory-openssl.html
secunia.com/advisories/30405 · Vendor Advisory
secunia.com/advisories/30460
secunia.com/advisories/30825
secunia.com/advisories/30852
secunia.com/advisories/30868
secunia.com/advisories/31228
secunia.com/advisories/31288
security.gentoo.org/glsa/glsa-200806-08.xml
slackware.com/security/viewer.php
sourceforge.net/project/shownotes.php
support.nortel.com/go/main.jsp
kb.cert.org/vuls/id/661475 · US Government Resource
mandriva.com/security/advisories
openssl.org/news/secadv_20080528.txt

More vulnerabilities in openssl

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free