CVE-2015-5334

Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an incorrect fix for CVE-2014-3508.

• CWE-787

• http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.1-relnotes.txtRelease Notes, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00050.htmlMailing List, Third Party Advisory
• http://packetstormsecurity.com/files/133998/Qualys-Security-Advisory-LibreSSL-Leak-Overflow.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Oct/75Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/archive/1/archive/1/536692/100/0/threadedBroken Link
• http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.1-relnotes.txtRelease Notes, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00050.htmlMailing List, Third Party Advisory
• http://packetstormsecurity.com/files/133998/Qualys-Security-Advisory-LibreSSL-Leak-Overflow.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Oct/75Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/archive/1/archive/1/536692/100/0/threadedBroken Link

Published

Jan 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5328Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-5329The TripleO Heat templates (tripleo-heat-templates), as used…
• CVE-2015-5330ldb before 1.1.24, as used in the AD LDAP server in Samba 4.…
• CVE-2015-5331Moodle 2.9.x before 2.9.3 does not properly check the contac…
• CVE-2015-5332Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 all…
• CVE-2015-5333Memory leak in the OBJ_obj2txt function in LibreSSL before 2…7.5
• CVE-2015-5335Cross-site request forgery (CSRF) vulnerability in admin/reg…
• CVE-2015-5336Multiple cross-site scripting (XSS) vulnerabilities in the s…
• CVE-2015-5337Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8…
• CVE-2015-5338Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-5339The core_enrol_get_enrolled_users web service in enrol/exter…
• CVE-2015-5340Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8…