CVE-2007-4995
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote...
9.3 HighFix available
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.
Exploit likelihood
10.5%Down 1.7 points since Feb 4, 2022
What each source reports
NVD Score used
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.
- Record
CVE-2007-4995- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.
- Record
CVE-2007-4995- Updated
- 2026-11-02
EUVDEUVD-2007-4976 No score
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.
- Record
EUVD-2007-4976- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wf86-8369-qhfj No score
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote...
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.
- Record
GHSA-wf86-8369-qhfj- Updated
- 2026-11-02
OSV No score
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.
- Record
CVE-2007-4995- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4995 No score
Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.
- Record
DEBIAN-CVE-2007-4995- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 |
before 0.9.8f-1 | 0.9.8f-1 |
opensslDebian:13 |
before 0.9.8f-1 | 0.9.8f-1 |
opensslDebian:14 |
before 0.9.8f-1 | 0.9.8f-1 |
opensslDebian:4.0 From an advisory covering 3 CVEs |
before 0.9.8c-4etch3, plus listed versions 0.9.8c-40.9.8c-4etch10.9.8c-4etch2 |
0.9.8c-4etch3 |
opensslRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
openssl-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
openssl-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
opensslRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
openssl-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
openssl-perlRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensslRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
openssl-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
openssl-develRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
openssl-perlRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:0.9.8b-8.3.el5_0.2 | 0:0.9.8b-8.3.el5_0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-4995 is a high vulnerability (CVSS 9.3) in Openssl, published October 13, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.5%, the 95th percentile. Fixed in openssl 0.9.8f-1.
References
support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=738962
securityfocus.com/archive/1/482167/100/0/threaded
secunia.com/advisories/28084
Show 194 moreShow less
debian.org/security/2008/dsa-1571
exchange.xforce.ibmcloud.com/vulnerabilities/37185
redhat.com/archives/fedora-package-announce/2007-October/msg00218.html
security.gentoo.org/glsa/glsa-200710-30.xml
mandriva.com/security/advisories?name=MDKSA-2007:237
vupen.com/english/advisories/2007/4219
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01299773
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10288
bugs.gentoo.org/show_bug.cgi?id=195634
gentoo.org/security/en/glsa/glsa-200805-07.xml
lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html
openssl.org/news/secadv_20071012.txt
securitytracker.com/id?1018810
usn.ubuntu.com/534-1
nvd.nist.gov/vuln/detail/CVE-2007-4995
github.com/advisories/GHSA-wf86-8369-qhfj
security-tracker.debian.org/tracker/CVE-2007-4995
access.redhat.com/errata/RHSA-2007:0964
bugzilla.redhat.com/show_bug.cgi?id=245732
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0964.json
cve.org/CVERecord?id=CVE-2007-3108
suse.com/support/update/announcement/-2022-445/suse-fu-20220445-1
bugzilla.suse.com/1000080
This page doesn't list everything
Left out here: 514 references. The JSON record has them.