[Pkg-openssl-devel] Bug#334938: libssl0.9.8: libcrypt-ssleay-perl seg faults via https addresses

[Kees Cook]

Package: libssl0.9.8
Version: 0.9.8a-2
Severity: grave
Justification: renders package unusable


There is a seg fault when using Perl LWP to access https sites:

#0  0xb7dc3942 in SSL_CTX_ctrl () from /usr/lib/i686/cmov/libssl.so.0.9.8
#1  0xb7de07de in XS_Crypt__SSLeay__CTX_new ()
   from /usr/lib/perl5/auto/Crypt/SSLeay/SSLeay.so
#2  0x080c0ad0 in Perl_pp_entersub ()
#3  0x080b95ba in Perl_runops_standard ()
#4  0x08064e43 in perl_run ()
#5  0x0805fd4f in main ()

For example:

$ perl -MHTTP::Request -MLWP::UserAgent -e '
    $agent = LWP::UserAgent->new();
    $request  = HTTP::Request->new("GET" => "https://www.osdl.org/");
    $response = $agent->request($request);
'
Segmentation fault


-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12-1-686-smp
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages libssl0.9.8 depends on:
ii  debconf [debconf-2.0]         1.4.58     Debian configuration management sy
ii  libc6                         2.3.5-6    GNU C Library: Shared libraries an

libssl0.9.8 recommends no packages.

-- debconf information:
  libssl0.9.8/restart-services: