Launchpad CVE tracker

CVE 2008-1678

Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.

Related bugs and status

CVE-2008-1678 (Candidate) is related to these bugs:

Bug #224945: [SRU] memory leaks in apache2 when running mod_ssl

		In	Importance	Status
224945	[SRU] memory leaks in apache2 when running mod_ssl	apache2 (Ubuntu)	High	Fix Released
224945	[SRU] memory leaks in apache2 when running mod_ssl	openssl (Ubuntu)	Undecided	Invalid
224945	[SRU] memory leaks in apache2 when running mod_ssl	apache2 (Ubuntu Hardy)	High	Fix Released
224945	[SRU] memory leaks in apache2 when running mod_ssl	openssl (Ubuntu Hardy)	Undecided	Invalid
224945	[SRU] memory leaks in apache2 when running mod_ssl	apache2 (Ubuntu Intrepid)	High	Fix Released
224945	[SRU] memory leaks in apache2 when running mod_ssl	openssl (Ubuntu Intrepid)	Undecided	Invalid

Bug #239894: CVE-2008-2364 Apache2 mod_proxy_http.c DOS

		In	Importance	Status
239894	CVE-2008-2364 Apache2 mod_proxy_http.c DOS	apache2 (Ubuntu)	Low	Fix Released
239894	CVE-2008-2364 Apache2 mod_proxy_http.c DOS	apache2 (Ubuntu Feisty)	Low	Won't Fix
239894	CVE-2008-2364 Apache2 mod_proxy_http.c DOS	apache2 (Ubuntu Gutsy)	Low	Fix Released
239894	CVE-2008-2364 Apache2 mod_proxy_http.c DOS	apache2 (Ubuntu Hardy)	Low	Fix Released
239894	CVE-2008-2364 Apache2 mod_proxy_http.c DOS	apache2 (Ubuntu Intrepid)	Low	Fix Released
239894	CVE-2008-2364 Apache2 mod_proxy_http.c DOS	apache2 (Ubuntu Dapper)	Low	Fix Released

Bug #581167: Please merge openssl 0.9.8n-1 into ubuntu

Summary				In	Importance	Status
	581167	Please merge openssl 0.9.8n-1 into ubuntu		openssl (Ubuntu)	Undecided	Fix Released

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2008-1678

References