CVE Feed

    Dashboard / CVE / CVE-2007-5135

    CVE-2007-5135

    Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a fix for CVE-2006-3738. As of 20071012, it is unknown whether code execution is possible.

    Published:Sep 27, 2007
    Last Modified:Apr 23, 2026
    EPS:Sep 27, 2007
    EPSS Score:0.47522
    CVSS Score:6.8

    Affected Products

    Vendor
    Openssl
    Product
    Openssl
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-193 Off-by-one Error

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-75803 (CVSS 9.1) — Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without ve…
    CVE-2026-63075 (CVSS 7.5) — Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets whi…
    CVE-2026-63072 (CVSS 7.5) — Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key s…
    CVE-2026-54874 (CVSS 7.5) — Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to b…
    CVE-2026-14457 (CVSS 7.5) — Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the p…
    CVE-2026-63076 (CVSS 7.5) — Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parame…
    CVE-2026-63074 (CVSS 5.9) — Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) s…
    CVE-2026-63073 (CVSS 9.8) — Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directl…
    CVE-2026-18798 (CVSS 7.5) — Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for i…
    CVE-2026-14456 (CVSS 7.5) — Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unkn…

    References

    ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-007.txt.asc
    http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
    http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
    http://lists.vmware.com/pipermail/security-announce/2008/000002.html
    http://secunia.com/advisories/22130
    http://secunia.com/advisories/27012
    http://secunia.com/advisories/27021
    http://secunia.com/advisories/27031
    http://secunia.com/advisories/27051
    http://secunia.com/advisories/27078
    http://secunia.com/advisories/27097
    http://secunia.com/advisories/27186
    http://secunia.com/advisories/27205
    http://secunia.com/advisories/27217
    http://secunia.com/advisories/27229
    http://secunia.com/advisories/27330
    http://secunia.com/advisories/27394
    http://secunia.com/advisories/27851
    http://secunia.com/advisories/27870
    http://secunia.com/advisories/27961
    http://secunia.com/advisories/28368
    http://secunia.com/advisories/29242
    http://secunia.com/advisories/30124
    http://secunia.com/advisories/30161
    http://secunia.com/advisories/31308
    http://secunia.com/advisories/31326
    http://secunia.com/advisories/31467
    http://secunia.com/advisories/31489
    http://security.freebsd.org/advisories/FreeBSD-SA-07:08.openssl.asc
    http://security.gentoo.org/glsa/glsa-200710-06.xml
    http://securityreason.com/securityalert/3179
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-103130-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-200858-1
    http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm
    http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0241
    http://www.debian.org/security/2007/dsa-1379
    http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:193
    http://www.novell.com/linux/security/advisories/2007_20_sr.html
    http://www.openbsd.org/errata40.html
    http://www.openbsd.org/errata41.html
    http://www.openbsd.org/errata42.html
    http://www.openssl.org/news/secadv_20071012.txt
    http://www.redhat.com/support/errata/RHSA-2007-0813.html
    http://www.redhat.com/support/errata/RHSA-2007-0964.html
    http://www.redhat.com/support/errata/RHSA-2007-1003.html
    http://www.securityfocus.com/archive/1/480855/100/0/threaded
    http://www.securityfocus.com/archive/1/481217/100/0/threaded
    http://www.securityfocus.com/archive/1/481488/100/0/threaded
    http://www.securityfocus.com/archive/1/481506/100/0/threaded
    http://www.securityfocus.com/archive/1/484353/100/0/threaded
    http://www.securityfocus.com/archive/1/485936/100/0/threaded
    http://www.securityfocus.com/archive/1/486859/100/0/threaded
    http://www.securityfocus.com/bid/25831
    http://www.securitytracker.com/id?1018755
    http://www.vmware.com/security/advisories/VMSA-2008-0001.html
    http://www.vmware.com/security/advisories/VMSA-2008-0013.html
    http://www.vupen.com/english/advisories/2007/3325
    http://www.vupen.com/english/advisories/2007/3625
    http://www.vupen.com/english/advisories/2007/4042
    http://www.vupen.com/english/advisories/2007/4144
    http://www.vupen.com/english/advisories/2008/0064
    http://www.vupen.com/english/advisories/2008/2268
    http://www.vupen.com/english/advisories/2008/2361
    http://www.vupen.com/english/advisories/2008/2362
    http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4037
    http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4038
    https://bugs.gentoo.org/show_bug.cgi?id=194039
    https://exchange.xforce.ibmcloud.com/vulnerabilities/36837
    https://issues.rpath.com/browse/RPL-1769
    https://issues.rpath.com/browse/RPL-1770
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10904
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5337
    https://usn.ubuntu.com/522-1/
    https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00218.html
    ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-007.txt.asc
    http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
    http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
    http://lists.vmware.com/pipermail/security-announce/2008/000002.html
    http://secunia.com/advisories/22130
    http://secunia.com/advisories/27012
    http://secunia.com/advisories/27021
    http://secunia.com/advisories/27031
    http://secunia.com/advisories/27051
    http://secunia.com/advisories/27078
    http://secunia.com/advisories/27097
    http://secunia.com/advisories/27186
    http://secunia.com/advisories/27205
    http://secunia.com/advisories/27217
    http://secunia.com/advisories/27229
    http://secunia.com/advisories/27330
    http://secunia.com/advisories/27394
    http://secunia.com/advisories/27851
    http://secunia.com/advisories/27870
    http://secunia.com/advisories/27961
    http://secunia.com/advisories/28368
    http://secunia.com/advisories/29242
    http://secunia.com/advisories/30124
    http://secunia.com/advisories/30161
    http://secunia.com/advisories/31308
    http://secunia.com/advisories/31326
    http://secunia.com/advisories/31467
    http://secunia.com/advisories/31489
    http://security.freebsd.org/advisories/FreeBSD-SA-07:08.openssl.asc
    http://security.gentoo.org/glsa/glsa-200710-06.xml
    http://securityreason.com/securityalert/3179
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-103130-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-200858-1
    http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm
    http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0241
    http://www.debian.org/security/2007/dsa-1379
    http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:193
    http://www.novell.com/linux/security/advisories/2007_20_sr.html
    http://www.openbsd.org/errata40.html
    http://www.openbsd.org/errata41.html
    http://www.openbsd.org/errata42.html
    http://www.openssl.org/news/secadv_20071012.txt
    http://www.redhat.com/support/errata/RHSA-2007-0813.html
    http://www.redhat.com/support/errata/RHSA-2007-0964.html
    http://www.redhat.com/support/errata/RHSA-2007-1003.html
    http://www.securityfocus.com/archive/1/480855/100/0/threaded
    http://www.securityfocus.com/archive/1/481217/100/0/threaded
    http://www.securityfocus.com/archive/1/481488/100/0/threaded
    http://www.securityfocus.com/archive/1/481506/100/0/threaded
    http://www.securityfocus.com/archive/1/484353/100/0/threaded
    http://www.securityfocus.com/archive/1/485936/100/0/threaded
    http://www.securityfocus.com/archive/1/486859/100/0/threaded
    http://www.securityfocus.com/bid/25831
    http://www.securitytracker.com/id?1018755
    http://www.vmware.com/security/advisories/VMSA-2008-0001.html
    http://www.vmware.com/security/advisories/VMSA-2008-0013.html
    http://www.vupen.com/english/advisories/2007/3325
    http://www.vupen.com/english/advisories/2007/3625
    http://www.vupen.com/english/advisories/2007/4042
    http://www.vupen.com/english/advisories/2007/4144
    http://www.vupen.com/english/advisories/2008/0064
    http://www.vupen.com/english/advisories/2008/2268
    http://www.vupen.com/english/advisories/2008/2361
    http://www.vupen.com/english/advisories/2008/2362
    http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4037
    http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4038
    https://bugs.gentoo.org/show_bug.cgi?id=194039
    https://exchange.xforce.ibmcloud.com/vulnerabilities/36837
    https://issues.rpath.com/browse/RPL-1769
    https://issues.rpath.com/browse/RPL-1770
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10904
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5337
    https://usn.ubuntu.com/522-1/
    https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00218.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High