CVE-2015-1792: The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 b...

Security readout for executives and security teams

This OpenSSL flaw can let remote input make affected software loop indefinitely while handling CMS/S/MIME data. The business impact is service interruption, not confirmed data theft or code execution. Exposure is most relevant where applications parse untrusted signed or encrypted messages using vulnerable OpenSSL versions. Internet-facing risk depends on whether an application accepts untrusted CMS/S/MIME inputs and links to a vulnerable OpenSSL build. General TLS use alone is not established by the supplied sources as sufficient exposure. Treat as a targeted availability risk. Remediate during normal vulnerability maintenance unless exposed CMS/S/MIME processing supports critical services, where patching should be prioritized sooner. Mitigation focus: Upgrade OpenSSL to a fixed version or vendor-supported backport.; Prioritize systems that process CMS or S/MIME content from untrusted sources.; Apply relevant OS or appliance vendor advisories listed in the source bundle..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.