CVE-2015-0292
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding...
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
- Record
CVE-2015-0292- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
- Record
CVE-2015-0292- Updated
- 2026-11-02
EUVDEUVD-2015-0305 No score
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
- Record
EUVD-2015-0305- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3467-h7vq-fjwx No score
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding...
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
- Record
GHSA-3467-h7vq-fjwx- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2015-0292
CVE-2015-0292 does not affect BellSoft software
- Record
BELL-CVE-2015-0292- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSVRHSA-2015:0800
Red Hat Security Advisory: openssl security update
- Record
RHSA-2015:0800- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 23 moreShow less
OSV No score
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
- Record
CVE-2015-0292- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-0292 No score
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
- Record
DEBIAN-CVE-2015-0292- Updated
- 2026-11-02
OSVSUSE-RU-2015:0769-1 No score
Security update for openssl1
This OpenSSL update fixes the following issues:
* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3513
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-RU-2015:0769-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0182-2 No score
Security update for compat-openssl097g
This compat-openssl097g rollup update contains various security fixes:
* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
can result in memory corruption during buffer management operations.
Security Issue reference:
* CVE-2012-2110
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
- Record
SUSE-SU-2015:0182-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:0543-1 No score
Security update for compat-openssl097g
This compat-openssl097g rollup update contains various security fixes:
* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
can result in memory corruption during buffer management operations.
Security Issue reference:
* CVE-2012-2110
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
- Record
SUSE-SU-2015:0543-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0545-1 No score
Security update for OpenSSL
OpenSSL has been updated to fix several security issues:
* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
compression by default. Setting the environment variable
'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
local attackers to gain access to transmitted plain text or private
keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.
Security Issue references:
* CVE-2013-0169
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
- Record
SUSE-SU-2015:0545-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0545-2 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:0545-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:0546-1 No score
Security update for openssl1
This OpenSSL update fixes the following issues:
* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3513
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:0546-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0547-1 No score
Security update for compat-openssl097g
OpenSSL was updated to fix several security issues:
* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
rejecting connections with DH parameters shorter than 1024 bits.
2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)
Additional changes:
* In the default SSL cipher string EXPORT ciphers are now disabled.
This will only get active if applications get rebuilt and actually
use this string. (bsc#931698)
Security Issues:
* CVE-2015-1789
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>
- Record
SUSE-SU-2015:0547-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0553-1 No score
Security update for compat-openssl098
OpenSSL was updated to fix various security issues.
Following security issues were fixed:
-
CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys.
-
CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections.
-
CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines.
-
CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods.
-
CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default.
-
CVE-2015-0292: Various issues in base64 decoding were fixed, which could lead to crashes with memory corruption, for instance by using attacker supplied PEM data.
-
CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default.
-
CVE-2009-5146: A memory leak in the TLS hostname extension was fixed, which could be used by remote attackers to run SSL services out of memory.
- Record
SUSE-SU-2015:0553-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0553-2 No score
Security update for compat-openssl098
OpenSSL was updated to fix various security issues.
Following security issues were fixed:
-
CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys.
-
CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections.
-
CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines.
-
CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods.
-
CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default.
-
CVE-2015-0292: Various issues in base64 decoding were fixed, which could lead to crashes with memory corruption, for instance by using attacker supplied PEM data.
-
CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default.
-
CVE-2009-5146: A memory leak in the TLS hostname extension was fixed, which could be used by remote attackers to run SSL services out of memory.
- Record
SUSE-SU-2015:0553-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:0578-1 No score
Security update for compat-openssl097g
This compat-openssl097g rollup update contains various security fixes:
* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
could have resulted in memory corruption during buffer management
operations.
Security Issue reference:
* CVE-2012-2110
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
- Record
SUSE-SU-2015:0578-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1182-1 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1182-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1182-2 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1182-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:1183-1 No score
Security update for compat-openssl097g
This compat-openssl097g rollup update contains various security fixes:
* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
could have resulted in memory corruption during buffer management
operations.
Security Issue reference:
* CVE-2012-2110
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
- Record
SUSE-SU-2015:1183-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1183-2 No score
Security update for compat-openssl097g
OpenSSL was updated to fix several security issues:
* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
rejecting connections with DH parameters shorter than 1024 bits.
2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)
Additional changes:
* In the default SSL cipher string EXPORT ciphers are now disabled.
This will only get active if applications get rebuilt and actually
use this string. (bsc#931698)
Security Issues:
* CVE-2015-1789
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>
- Record
SUSE-SU-2015:1183-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:1184-1 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1184-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1184-2 No score
Security update for OpenSSL
OpenSSL has been updated to fix several security issues:
* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
compression by default. Setting the environment variable
'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
local attackers to gain access to transmitted plain text or private
keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.
Security Issue references:
* CVE-2013-0169
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
- Record
SUSE-SU-2015:1184-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:1185-1 No score
Security update for openssl1
This OpenSSL update fixes the following issues:
* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3513
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1185-1- Updated
- 2026-11-02
OSVSUSE-SU-403 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-403- Updated
- 2026-11-02
OSVSUSE-SU-403 Forbidden-1 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-403 Forbidden-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-0292 No score
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
- Record
UBUNTU-CVE-2015-0292- Updated
- 2026-11-02
OSVUSN-2537-1 No score
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled malformed EC private key files. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0209)
Stephen Henson discovered that OpenSSL incorrectly handled comparing ASN.1 boolean types. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0286)
Emilia Käsper discovered that OpenSSL incorrectly handled ASN.1 structure reuse. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0287)
Brian Carpenter discovered that OpenSSL incorrectly handled invalid certificate keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0288)
Michal Zalewski discovered that OpenSSL incorrectly handled missing outer ContentInfo when parsing PKCS#7 structures. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0289)
Robert Dugal and David Ramos discovered that OpenSSL incorrectly handled decoding Base64 encoded data. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0292)
Sean Burford and Emilia Käsper discovered that OpenSSL incorrectly handled specially crafted SSLv2 CLIENT-MASTER-KEY messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0293)
- Record
USN-2537-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 |
before 1.0.1h-1 | 1.0.1h-1 |
opensslDebian:13 |
before 1.0.1h-1 | 1.0.1h-1 |
opensslDebian:14 |
before 1.0.1h-1 | 1.0.1h-1 |
opensslDebian:6.0 From an advisory covering 7 CVEs |
before 0.9.8o-4squeeze20, plus listed versions 0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13 Show 14 moreShow less0.9.8o-4squeeze140.9.8o-4squeeze150.9.8o-4squeeze160.9.8o-4squeeze170.9.8o-4squeeze180.9.8o-4squeeze190.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9 |
0.9.8o-4squeeze20 |
opensslDebian:7 From an advisory covering 6 CVEs |
before 1.0.1e-2+deb7u15, plus listed versions 1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u101.0.1e-2+deb7u111.0.1e-2+deb7u12 Show 10 moreShow less1.0.1e-2+deb7u131.0.1e-2+deb7u141.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9 |
1.0.1e-2+deb7u15 |
opensslRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-staticRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
Show 84 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensslRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-staticRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
opensslRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-staticRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
opensslRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-staticRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
opensslRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-libsRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-develRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-perlRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-staticRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
opensslRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-libsRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-develRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-perlRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-staticRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
opensslRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-develRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-libsRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-perlRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-staticRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
opensslRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-develRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-libsRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-perlRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-staticRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
opensslRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-staticRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
opensslRed Hat:enterprise_linux:5::client From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
openssl-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
openssl-perlRed Hat:enterprise_linux:5::client From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
opensslRed Hat:enterprise_linux:5::client_workstation From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
openssl-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
openssl-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
opensslRed Hat:enterprise_linux:5::server From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
openssl-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
openssl-develRed Hat:enterprise_linux:5::server From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
openssl-perlRed Hat:enterprise_linux:5::server From an advisory covering 9 CVEs |
before 0:0.9.8e-33.el5_11 | 0:0.9.8e-33.el5_11 |
compat-openssl098SUSE:Linux Enterprise Module for Legacy 12 From an advisory covering 8 CVEs |
before 0.9.8j-73.2 | 0.9.8j-73.2 |
compat-openssl098SUSE:Linux Enterprise Desktop 12 From an advisory covering 8 CVEs |
before 0.9.8j-73.2 | 0.9.8j-73.2 |
libqt4SUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
opensslUbuntu:14.04:LTS |
before 1.0.1f-1ubuntu2.11, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 9 moreShow less1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.8 |
1.0.1f-1ubuntu2.11 |
opensslUbuntu:14.04:LTS From an advisory covering 7 CVEs |
before 1.0.1f-1ubuntu2.11, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 9 moreShow less1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.8 |
1.0.1f-1ubuntu2.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0292 is a high vulnerability (CVSS 7.5) in Openssl, published August 30, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 42.5%, the 98th percentile. Fixed in openssl 1.0.1h-1.
References
kc.mcafee.com/corporate/index?page=content&id=SB10110
oracle.com/technetwork/topics/security/cpujul2015-2367936.html
rhn.redhat.com/errata/RHSA-2015-0715.html
kb.juniper.net/InfoCenter/index?page=content&id=JSA10680
debian.org/security/2015/dsa-3197
ubuntu.com/usn/USN-2537-1
Show 194 moreShow less
marc.info?l=bugtraq&m=144050155601375&w=2
lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
bto.bluecoat.com/security-advisory/sa92
openssl.org/news/secadv_20150319.txt
rt.openssl.org/Ticket/Display.html?id=2608&user=guest&pass=guest
bugzilla.redhat.com/show_bug.cgi?id=1202395
access.redhat.com/articles/1384453
securityfocus.com/bid/73228
fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015
lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
git.openssl.org/gitweb?p=openssl.git%3Ba=commit%3Bh=d0666f289ac013094bbbf547bfbcd616199b7d2d
securitytracker.com/id/1031929
support.citrix.com/article/CTX216642
security.gentoo.org/glsa/201503-11
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
nvd.nist.gov/vuln/detail/CVE-2015-0292
github.com/advisories/GHSA-3467-h7vq-fjwx
docs.bell-sw.com/security/cves/CVE-2015-0292
security-tracker.debian.org/tracker/CVE-2015-0292
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0715.json
cve.org/CVERecord?id=CVE-2015-0209
securityblog.redhat.com/2015/03/04/factoring-rsa-export-keys-freak-cve-2015-0204
suse.com/support/update/announcement//suse-ru-20150769-1
bugzilla.suse.com/860332
ubuntu.com/security/CVE-2015-0292
Left out here: 59 references. The JSON record has them.