Two vulnerabilities have been reported in OpenSSL, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service) in an application using the library.

1) An error in the CMS and PKCS #7 decryption code can be exploited via a so-called "Million Message Attack" against CMS, PKCS #7, or S/MIME decryption operations.

Successful exploitation of this vulnerability requires sending on average 2^20 messages, affecting only automated systems in practise.

2) A NULL-pointer dereference error in the "mime_param_cmp()" function (crypto/asn1/asn_mime.c) when parsing certain MIME headers can be exploited to cause a crash.

Solution
Update to version 1.0.0h or 0.9.8u.

Provided and/or discovered by
1) The vendor credits Ivan Nestlerode.
2) Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.openssl.org/news/secadv_20120312.txt
http://cvs.openssl.org/chngview?cn=22252

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers