CVE-2015-0205

The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1...

5.0 MediumPublic exploitFix available

The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.

Exploit likelihood

22.3%Up 14.8 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2015-0205
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-0205
Updated: 2026-11-02

EUVDEUVD-2015-0242 No score

Record: EUVD-2015-0242
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j635-3m2r-m6v7 No score

The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1...

Record: GHSA-j635-3m2r-m6v7
Updated: 2026-11-02

OSVRHSA-2015:0066 5.3

Red Hat Security Advisory: openssl security update

Record: RHSA-2015:0066
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSV No score

Record: CVE-2015-0205
Updated: 2026-11-02

Show 30 moreShow less

OSVDEBIAN-CVE-2015-0205 No score

Record: DEBIAN-CVE-2015-0205
Updated: 2026-11-02

OSVMGASA-2015-0022 No score

Updated openssl packages fix security vulnerabilities

A carefully crafted DTLS message can cause a segmentation fault in OpenSSL due to a NULL pointer dereference. This could lead to a Denial Of Service attack (CVE-2014-3571).

A memory leak can occur in the dtls1_buffer_record function under certain conditions. In particular this could occur if an attacker sent repeated DTLS records with the same sequence number but for the next epoch. The memory leak could be exploited by an attacker in a Denial of Service attack through memory exhaustion (CVE-2015-0206).

When openssl is built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl method would be set to NULL which could later result in a NULL pointer dereference (CVE-2014-3569).

An OpenSSL client will accept a handshake using an ephemeral ECDH ciphersuite using an ECDSA certificate if the server key exchange message is omitted. This effectively removes forward secrecy from the ciphersuite (CVE-2014-3572).

An OpenSSL client will accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. A server could present a weak temporary key and downgrade the security of the session (CVE-2015-0204).

An OpenSSL server will accept a DH certificate for client authentication without the certificate verify message. This effectively allows a client to authenticate without the use of a private key. This only affects servers which trust a client certificate authority which issues certificates containing DH keys: these are extremely rare and hardly ever encountered (CVE-2015-0205).

OpenSSL accepts several non-DER-variations of certificate signature algorithm and signature encodings. OpenSSL also does not enforce a match between the signature algorithm between the signed and unsigned portions of the certificate. By modifying the contents of the signature algorithm or the encoding of the signature, it is possible to change the certificate's fingerprint. This does not allow an attacker to forge certificates, and does not affect certificate verification or OpenSSL servers/clients in any other way. It also does not affect common revocation mechanisms. Only custom applications that rely on the uniqueness of the fingerprint (e.g. certificate blacklists) may be affected (CVE-2014-8275).

Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64. This bug occurs at random with a very low probability, and is not known to be exploitable in any way, though its exact impact is difficult to determine (CVE-2014-3570).

The updated packages have been upgraded to the 1.0.1k version where these security flaws have been fixed.

Record: MGASA-2015-0022
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10271-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10309-1 No score

libcrypto38-2.5.0-1.1 on GA media

These are all security issues fixed in the libcrypto38-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10309-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10529-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11127-1
Updated: 2026-11-02

OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

Introduce venv-salt-minion.
Mention fixed issues provided with the bundle.

Record: SUSE-FU-2022:0445-1
Updated: 2026-11-02

OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-RU-2015:0769-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0182-2 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

Record: SUSE-SU-2015:0182-2
Updated: 2026-11-02

OSVSUSE-SU-2015:0305-1 No score

Security update for compat-openssl098

The openssl 0.9.8j compatibility package was updated to fix several security vulnerabilities:

CVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64.

CVE-2014-3571: Fix crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record.

CVE-2014-3572: Do not accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted.

CVE-2014-8275: Fixed various certificate fingerprint issues

CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites

CVE-2015-0205: OpenSSL 0.9.8j is NOT vulnerable to CVE-2015-0205 as it doesn't support DH certificates and this typo prohibits skipping of certificate verify message for sign only certificates anyway. (This patch only fixes the wrong condition)

This update also fixes regression caused by CVE-2014-0224.patch (bnc#892403)

Record: SUSE-SU-2015:0305-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0543-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

Record: SUSE-SU-2015:0543-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0545-1 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>

Record: SUSE-SU-2015:0545-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0545-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:0545-2
Updated: 2026-11-02

OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:0546-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0547-1 No score

Security update for compat-openssl097g

OpenSSL was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
  rejecting connections with DH parameters shorter than 1024 bits.
  2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
  was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
  This will only get active if applications get rebuilt and actually
  use this string. (bsc#931698)

Security Issues:

* CVE-2015-1789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>

Record: SUSE-SU-2015:0547-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0578-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

Record: SUSE-SU-2015:0578-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0620-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>

Record: SUSE-SU-2015:0620-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0946-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>

Record: SUSE-SU-2015:0946-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1177-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>

Record: SUSE-SU-2015:1177-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1182-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:1182-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1182-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:1182-2
Updated: 2026-11-02

OSVSUSE-SU-2015:1183-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

Record: SUSE-SU-2015:1183-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1183-2 No score

Security update for compat-openssl097g

OpenSSL was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
  rejecting connections with DH parameters shorter than 1024 bits.
  2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
  was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
  This will only get active if applications get rebuilt and actually
  use this string. (bsc#931698)

Security Issues:

* CVE-2015-1789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>

Record: SUSE-SU-2015:1183-2
Updated: 2026-11-02

OSVSUSE-SU-2015:1184-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:1184-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1184-2 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>

Record: SUSE-SU-2015:1184-2
Updated: 2026-11-02

OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:1185-1
Updated: 2026-11-02

OSVSUSE-SU-403 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-403
Updated: 2026-11-02

OSVSUSE-SU-403 Forbidden-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-403 Forbidden-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-0205 No score

Record: UBUNTU-CVE-2015-0205
Updated: 2026-11-02

OSVUSN-2459-1 No score

openssl vulnerabilities

Pieter Wuille discovered that OpenSSL incorrectly handled Bignum squaring. (CVE-2014-3570)

Markus Stenberg discovered that OpenSSL incorrectly handled certain crafted DTLS messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2014-3571)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled certain handshakes. A remote attacker could possibly use this issue to downgrade to ECDH, removing forward secrecy from the ciphersuite. (CVE-2014-3572)

Antti Karjalainen, Tuomo Untinen and Konrad Kraszewski discovered that OpenSSL incorrectly handled certain certificate fingerprints. A remote attacker could possibly use this issue to trick certain applications that rely on the uniqueness of fingerprints. (CVE-2014-8275)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled certain key exchanges. A remote attacker could possibly use this issue to downgrade the security of the session to EXPORT_RSA. (CVE-2015-0204)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled client authentication. A remote attacker could possibly use this issue to authenticate without the use of a private key in certain limited scenarios. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0205)

Chris Mueller discovered that OpenSSL incorrect handled memory when processing DTLS records. A remote attacker could use this issue to cause OpenSSL to consume resources, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0206)

Record: USN-2459-1
Updated: 2026-11-02

Affected products

openssl

Affected packages

Affected packages
Package	Affected	Fixed
`openssl` Debian:12	before 1.0.1k-1	1.0.1k-1
`openssl` Debian:13	before 1.0.1k-1	1.0.1k-1
`openssl` Debian:14	before 1.0.1k-1	1.0.1k-1
`openssl` Debian:7 From an advisory covering 8 CVEs	before 1.0.1e-2+deb7u14, plus listed versions 1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u101.0.1e-2+deb7u111.0.1e-2+deb7u12 Show 9 moreShow less 1.0.1e-2+deb7u131.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9	1.0.1e-2+deb7u14
`openssl` Mageia:4 From an advisory covering 9 CVEs	before 1.0.1k-1.mga4	1.0.1k-1.mga4
`openssl` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-debuginfo` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-devel` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-perl` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-static` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5

Show 71 moreShow less

Affected packages
Package	Affected	Fixed
`openssl` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-debuginfo` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-devel` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-perl` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-static` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-debuginfo` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-devel` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-perl` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-static` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-debuginfo` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-devel` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-perl` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-static` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-libs` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-devel` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-perl` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-static` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-libs` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-devel` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-perl` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-static` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-devel` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-libs` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-perl` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-static` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-devel` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-libs` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-perl` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-static` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`compat-openssl098` SUSE:Linux Enterprise Desktop 12 From an advisory covering 7 CVEs	before 0.9.8j-70.2	0.9.8j-70.2
`compat-openssl098` SUSE:Linux Enterprise Module for Legacy 12 From an advisory covering 7 CVEs	before 0.9.8j-70.2	0.9.8j-70.2
`libqt4` SUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-sql-plugins` SUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-sql-plugins` SUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-sql-plugins` SUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-sql-plugins` SUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`openssl` Ubuntu:14.04:LTS	before 1.0.1f-1ubuntu2.8, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 8 moreShow less 1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.7	1.0.1f-1ubuntu2.8
`openssl` Ubuntu:14.04:LTS From an advisory covering 7 CVEs	before 1.0.1f-1ubuntu2.8, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 8 moreShow less 1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.7	1.0.1f-1ubuntu2.8
`libressl` openSUSE:Tumbleweed From an advisory covering 30 CVEs	before 2.5.0-1.1	2.5.0-1.1
`openssl-1_1` openSUSE:Tumbleweed From an advisory covering 136 CVEs	before 1.1.1l-1.2	1.1.1l-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	saurabh2088/OpenSSL_1_0_1g_CVE-2015-0205	2024-04-09

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0205 is a medium vulnerability (CVSS 5.0) in Openssl, published August 30, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 22.3%, the 97th percentile. Fixed in openssl 1.0.1k-1.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 766 references. The JSON record has them.