Every CVE Search/ Get API key

CVE-2015-0209

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL...

6.8 MediumFix available

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

Exploit likelihood

16.4%Up 8.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

Record
CVE-2015-0209
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

Record
CVE-2015-0209
Updated
2026-11-02
EUVDEUVD-2015-0246 No score

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

Record
EUVD-2015-0246
Updated
2026-11-03
GitHub AdvisoriesGHSA-gc3c-j46x-fm67 No score

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL...

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

Record
GHSA-gc3c-j46x-fm67
Updated
2026-11-02
OSVBELL-CVE-2015-0209 6.8

CVE-2015-0209 does not affect BellSoft software

Record
BELL-CVE-2015-0209
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSV No score

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

Record
CVE-2015-0209
Updated
2026-11-02
Show 23 moreShow less
OSVDEBIAN-CVE-2015-0209 No score

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

Record
DEBIAN-CVE-2015-0209
Updated
2026-11-02
OSVMGASA-2015-0111 No score

Updated openssl packages fix security vulnerabilities

Updated openssl packages fix security vulnerabilities:

The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check certificate signature algorithm consistency this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication (CVE-2015-0286).

Reusing a structure in ASN.1 parsing may allow an attacker to cause memory corruption via an invalid write. Such reuse is and has been strongly discouraged and is believed to be rare. Certificate parsing, OpenSSL clients, and OpenSSL servers are not affected (CVE-2015-0287).

The PKCS#7 parsing code does not handle missing outer ContentInfo correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. OpenSSL clients and servers are not affected (CVE-2015-0289).

A malicious client can trigger an OPENSSL_assert (i.e., an abort) in servers that both support SSLv2 and enable export cipher suites by sending a specially crafted SSLv2 CLIENT-MASTER-KEY message (CVE-2015-0293).

A malformed EC private key file consumed via the d2i_ECPrivateKey function could cause a use after free condition. This, in turn, could cause a double free in several private key parsing functions (such as d2i_PrivateKey or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption for applications that receive EC private keys from untrusted sources. This scenario is considered rare (CVE-2015-0209).

The function X509_to_X509_REQ will crash with a NULL pointer dereference if the certificate key is invalid. This function is rarely used in practice (CVE-2015-0288).

Record
MGASA-2015-0111
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10309-1 No score

libcrypto38-2.5.0-1.1 on GA media

These are all security issues fixed in the libcrypto38-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10309-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-RU-2015:0769-1
Updated
2026-11-02
OSVSUSE-SU-2015:0541-1 No score

Security update for openssl

OpenSSL was updated to fix various security issues.

Following security issues were fixed:

  • CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys.

  • CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections.

  • CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines.

  • CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods.

  • CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default.

  • CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default.

Record
SUSE-SU-2015:0541-1
Updated
2026-11-02
OSVSUSE-SU-2015:0545-1 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
Record
SUSE-SU-2015:0545-1
Updated
2026-11-02
OSVSUSE-SU-2015:0545-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0545-2
Updated
2026-11-02
OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0546-1
Updated
2026-11-02
OSVSUSE-SU-2015:0553-1 No score

Security update for compat-openssl098

OpenSSL was updated to fix various security issues.

Following security issues were fixed:

  • CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys.

  • CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections.

  • CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines.

  • CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods.

  • CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default.

  • CVE-2015-0292: Various issues in base64 decoding were fixed, which could lead to crashes with memory corruption, for instance by using attacker supplied PEM data.

  • CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default.

  • CVE-2009-5146: A memory leak in the TLS hostname extension was fixed, which could be used by remote attackers to run SSL services out of memory.

Record
SUSE-SU-2015:0553-1
Updated
2026-11-02
OSVSUSE-SU-2015:0553-2 No score

Security update for compat-openssl098

OpenSSL was updated to fix various security issues.

Following security issues were fixed:

  • CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys.

  • CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections.

  • CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines.

  • CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods.

  • CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default.

  • CVE-2015-0292: Various issues in base64 decoding were fixed, which could lead to crashes with memory corruption, for instance by using attacker supplied PEM data.

  • CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default.

  • CVE-2009-5146: A memory leak in the TLS hostname extension was fixed, which could be used by remote attackers to run SSL services out of memory.

Record
SUSE-SU-2015:0553-2
Updated
2026-11-02
OSVSUSE-SU-2015:1182-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1182-1
Updated
2026-11-02
OSVSUSE-SU-2015:1182-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1182-2
Updated
2026-11-02
OSVSUSE-SU-2015:1184-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1184-1
Updated
2026-11-02
OSVSUSE-SU-2015:1184-2 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
Record
SUSE-SU-2015:1184-2
Updated
2026-11-02
OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1185-1
Updated
2026-11-02
OSVSUSE-SU-403 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-403
Updated
2026-11-02
OSVSUSE-SU-403 Forbidden-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-403 Forbidden-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-0209 No score

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

Record
UBUNTU-CVE-2015-0209
Updated
2026-11-02
OSVUSN-2537-1 No score

openssl vulnerabilities

It was discovered that OpenSSL incorrectly handled malformed EC private key files. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0209)

Stephen Henson discovered that OpenSSL incorrectly handled comparing ASN.1 boolean types. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0286)

Emilia Käsper discovered that OpenSSL incorrectly handled ASN.1 structure reuse. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0287)

Brian Carpenter discovered that OpenSSL incorrectly handled invalid certificate keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0288)

Michal Zalewski discovered that OpenSSL incorrectly handled missing outer ContentInfo when parsing PKCS#7 structures. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0289)

Robert Dugal and David Ramos discovered that OpenSSL incorrectly handled decoding Base64 encoded data. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0292)

Sean Burford and Emilia Käsper discovered that OpenSSL incorrectly handled specially crafted SSLv2 CLIENT-MASTER-KEY messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0293)

Record
USN-2537-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 1.0.1k-2
1.0.1k-2
openssl
Debian:13
 before 1.0.1k-2
1.0.1k-2
openssl
Debian:14
 before 1.0.1k-2
1.0.1k-2
openssl
Debian:6.0
 before 0.9.8o-4squeeze20, plus listed versions
0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13
Show 14 moreShow less
0.9.8o-4squeeze140.9.8o-4squeeze150.9.8o-4squeeze160.9.8o-4squeeze170.9.8o-4squeeze180.9.8o-4squeeze190.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9
0.9.8o-4squeeze20
openssl
Debian:7
 before 1.0.1e-2+deb7u15, plus listed versions
1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u101.0.1e-2+deb7u111.0.1e-2+deb7u12
Show 10 moreShow less
1.0.1e-2+deb7u131.0.1e-2+deb7u141.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9
1.0.1e-2+deb7u15
openssl
Mageia:4
 before 1.0.1m-1.mga4
1.0.1m-1.mga4
openssl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-devel
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-perl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
Show 80 moreShow less
Affected packages
PackageAffectedFixed
openssl-static
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-perl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-static
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-devel
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-perl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-static
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-perl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-static
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-debuginfo
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-libs
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-devel
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-perl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-static
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-libs
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-devel
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-perl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-static
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-42.ael7b_1.4
1:1.0.1e-42.ael7b_1.4
openssl-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-42.ael7b_1.4
1:1.0.1e-42.ael7b_1.4
openssl-devel
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-42.ael7b_1.4
1:1.0.1e-42.ael7b_1.4
openssl-libs
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-42.ael7b_1.4
1:1.0.1e-42.ael7b_1.4
openssl-perl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-42.ael7b_1.4
1:1.0.1e-42.ael7b_1.4
openssl-static
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-42.ael7b_1.4
1:1.0.1e-42.ael7b_1.4
openssl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-devel
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-libs
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-perl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl-static
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-42.el7_1.4
1:1.0.1e-42.el7_1.4
openssl
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-debuginfo
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-devel
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-perl
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl-static
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-30.el6_6.7
0:1.0.1e-30.el6_6.7
openssl
SUSE:Linux Enterprise Desktop 12
 before 1.0.1i-20.1
1.0.1i-20.1
openssl
SUSE:Linux Enterprise Software Development Kit 12
 before 1.0.1i-20.1
1.0.1i-20.1
openssl
SUSE:Linux Enterprise Server 12
 before 1.0.1i-20.1
1.0.1i-20.1
openssl
SUSE:Linux Enterprise Server for SAP Applications 12
 before 1.0.1i-20.1
1.0.1i-20.1
compat-openssl098
SUSE:Linux Enterprise Module for Legacy 12
 before 0.9.8j-73.2
0.9.8j-73.2
compat-openssl098
SUSE:Linux Enterprise Desktop 12
 before 0.9.8j-73.2
0.9.8j-73.2
libqt4
SUSE:Linux Enterprise Desktop 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Desktop 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Desktop 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Desktop 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Software Development Kit 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Software Development Kit 12
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Software Development Kit 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server 12
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server for SAP Applications 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 12
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server for SAP Applications 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server 12 SP1
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Workstation Extension 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Workstation Extension 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Workstation Extension 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Workstation Extension 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
openssl
Ubuntu:14.04:LTS
 before 1.0.1f-1ubuntu2.11, plus listed versions
1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4
Show 9 moreShow less
1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.8
1.0.1f-1ubuntu2.11
libressl
openSUSE:Tumbleweed
 before 2.5.0-1.1
2.5.0-1.1
openssl-1_1
openSUSE:Tumbleweed
 before 1.1.1l-1.2
1.1.1l-1.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0209 is a medium vulnerability (CVSS 6.8) in Openssl, published March 25, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.4%, the 96th percentile. Fixed in openssl 1.0.1k-2.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 640 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open