OpenSSL Information Disclosure Vulnerability

Heap Use-After-Free in the PKCS7_verify() Function

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

DTLS Retransmits Handshake Messages From a Stale Buffer Offset

The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process…

Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion

Potential Use-after-free in DANE Client Code

POLY1305 MAC implementation corrupts XMM registers on Windows

QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

Use-After-Free in X.509 Extension Cache Under Concurrent Use

Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake

QUIC STREAM Fragment Metadata DoS

Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

Heap Buffer Overflow in CMS Key Unwrapping

Excessive Memory Use Buffering DTLS Records for a Future Epoch

QUIC Server May Trigger Double Free When Processing INITIAL Packet

RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

Unbounded Memory Growth in QUIC Server Incoming Channel Queue

Client-Side Memory Leak in OCSP Response Checking

AES-OCB IV Ignored on EVP_Cipher() Path

NULL Dereference in Certificate Verification with OCSP Checking

NULL Pointer Dereference in QUIC Server Initial Packet Handling

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

Heap Buffer Over-read in ASN.1 Content Parsing

Out-of-Bounds Read in CMS Password-Based Decryption

Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo

NULL Pointer Dereference When Processing a Delta CRL

Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support

NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function

Missing ASN1_TYPE validation in TS_RESP_verify_response() function

Out-of-bounds read & write in RFC 3211 KEK Unwrap

Possible denial of service in X.509 name checks

Incorrect cipher key & IV length processing

Excessive Resource Usage Verifying X.509 Policy Constraints

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data

An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions

Double free after calling PEM_read_bio_ex

Use-after-free following BIO_new_NDEF

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively

X.509 Email Address 4-byte Buffer Overflow

X.509 Email Address Variable Length Buffer Overflow

Using a Custom Cipher with NID_undef may lead to NULL encryption

Resource leakage when decoding certificates and keys

Infinite loop in BN_mod_sqrt() reachable when parsing certificates

Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable…