The PKCS#7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected. (original advisory). Reported by Michal Zalewski (Google). http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790
