Every CVE Search/ Get API key

CVE-2014-0224

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict...

7.4 HighPublic exploitFix available

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

95.3%Up 0.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.4

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Record
CVE-2014-0224
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-326
Updated
2026-11-02
CVE List No score

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Record
CVE-2014-0224
Updated
2026-11-02
EUVDEUVD-2014-0267 No score

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Record
EUVD-2014-0267
Updated
2026-11-03
GitHub AdvisoriesGHSA-84gm-v5wh-659w 7.4

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict...

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Record
GHSA-84gm-v5wh-659w
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-326
Updated
2026-11-02
OSVBELL-CVE-2014-0224 7.4

CVE-2014-0224 does not affect BellSoft software

Record
BELL-CVE-2014-0224
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSV 7.4

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Record
CVE-2014-0224
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 30 moreShow less
OSVDEBIAN-CVE-2014-0224 7.4

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Record
DEBIAN-CVE-2014-0224
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0224 7.4

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Record
UBUNTU-CVE-2014-0224
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2014-0255 No score

Updated openssl packages fix multiple vulnerabilties

Updated openssl packages fix security vulnerabilities:

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. (CVE-2014-0224)

Note: In order to exploit this flaw, both the server and the client must be using a vulnerable version of OpenSSL; the server must be using OpenSSL version 1.0.1 and above, and the client must be using any version of OpenSSL. For more information about this flaw, refer to RedHat article 904433 in the references. All currently supported versions of Mageia are running OpenSSL 1.0.1.

A buffer overflow flaw was found in the way OpenSSL handled invalid DTLS packet fragments. A remote attacker could possibly use this flaw to execute arbitrary code on a DTLS client or server. (CVE-2014-0195)

A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash. (CVE-2014-0221)

A NULL pointer dereference flaw was found in the way OpenSSL performed anonymous Elliptic Curve Diffie Hellman (ECDH) key exchange. A specially crafted handshake packet could cause a TLS/SSL client that has the anonymous ECDH cipher suite enabled to crash. (CVE-2014-3470)

Record
MGASA-2014-0255
Updated
2026-11-02
OSVopenSUSE-SU-2024:10020-1 No score

python-virtualbox-5.1.10-2.5 on GA media

These are all security issues fixed in the python-virtualbox-5.1.10-2.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10020-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-RU-2015:0769-1
Updated
2026-11-02
OSVSUSE-SU-2015:0182-2 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:0182-2
Updated
2026-11-02
OSVSUSE-SU-2015:0305-1 No score

Security update for compat-openssl098

The openssl 0.9.8j compatibility package was updated to fix several security vulnerabilities:

CVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64.

CVE-2014-3571: Fix crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record.

CVE-2014-3572: Do not accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted.

CVE-2014-8275: Fixed various certificate fingerprint issues

CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites

CVE-2015-0205: OpenSSL 0.9.8j is NOT vulnerable to CVE-2015-0205 as it doesn't support DH certificates and this typo prohibits skipping of certificate verify message for sign only certificates anyway. (This patch only fixes the wrong condition)

This update also fixes regression caused by CVE-2014-0224.patch (bnc#892403)

Record
SUSE-SU-2015:0305-1
Updated
2026-11-02
OSVSUSE-SU-2015:0543-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:0543-1
Updated
2026-11-02
OSVSUSE-SU-2015:0545-1 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
Record
SUSE-SU-2015:0545-1
Updated
2026-11-02
OSVSUSE-SU-2015:0545-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0545-2
Updated
2026-11-02
OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0546-1
Updated
2026-11-02
OSVSUSE-SU-2015:0578-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:0578-1
Updated
2026-11-02
OSVSUSE-SU-2015:0620-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
Record
SUSE-SU-2015:0620-1
Updated
2026-11-02
OSVSUSE-SU-2015:0743-1 No score

Security update for mariadb

mariadb was updated to version 10.0.16 to fix 40 security issues.

These security issues were fixed:

  • CVE-2015-0411: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption (bnc#915911).
  • CVE-2015-0382: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allowed remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381 (bnc#915911).
  • CVE-2015-0381: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allowed remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382 (bnc#915911).
  • CVE-2015-0432: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allowed remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key (bnc#915911).
  • CVE-2014-6568: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allowed remote authenticated users to affect availability via vectors related to Server : InnoDB : DML (bnc#915911).
  • CVE-2015-0374: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allowed remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key (bnc#915911).
  • CVE-2014-6507: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (bnc#915912).
  • CVE-2014-6491: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6500 (bnc#915912).
  • CVE-2014-6500: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491 (bnc#915912).
  • CVE-2014-6469: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and eariler and 5.6.20 and earlier allowed remote authenticated users to affect availability via vectors related to SERVER:OPTIMIZER (bnc#915912).
  • CVE-2014-6555: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allowed remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (bnc#915912).
  • CVE-2014-6559: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING (bnc#915912).
  • CVE-2014-6494: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6496 (bnc#915912).
  • CVE-2014-6496: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494 (bnc#915912).
  • CVE-2014-6464: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allowed remote authenticated users to affect availability via vectors related to SERVER:INNODB DML FOREIGN KEYS (bnc#915912).
  • CVE-2010-5298: Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when…
Record
SUSE-SU-2015:0743-1
Updated
2026-11-02
OSVSUSE-SU-2015:0946-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
Record
SUSE-SU-2015:0946-1
Updated
2026-11-02
OSVSUSE-SU-2015:1177-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
Record
SUSE-SU-2015:1177-1
Updated
2026-11-02
OSVSUSE-SU-2015:1182-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1182-1
Updated
2026-11-02
OSVSUSE-SU-2015:1182-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1182-2
Updated
2026-11-02
OSVSUSE-SU-2015:1183-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:1183-1
Updated
2026-11-02
OSVSUSE-SU-2015:1184-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1184-1
Updated
2026-11-02
OSVSUSE-SU-2015:1184-2 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
Record
SUSE-SU-2015:1184-2
Updated
2026-11-02
OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1185-1
Updated
2026-11-02
OSVSUSE-SU-2019:14246-1 No score

Security update for Mozilla Firefox

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

  • Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

  • Various security fixes: MFSA 2019-33 (bsc#1154738)

    • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
    • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
    • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
    • CVE-2019-11759: Stack buffer overflow in HKDF output
    • CVE-2019-11760: Stack buffer overflow in WebRTC networking
    • CVE-2019-11761: Unintended access to a privileged JSONView object
    • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
    • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
    • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

  • [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
  • [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
  • [bsc#1043008] Firefox hangs randomly when browsing and scrolling
  • [bsc#1025108] Firefox stops loading page until mouse is moved
  • [bsc#905528] Firefox malfunctions due to broken omni.ja archives
Record
SUSE-SU-2019:14246-1
Updated
2026-11-02
OSVSUSE-SU-403 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-403
Updated
2026-11-02
OSVSUSE-SU-403 Forbidden-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-403 Forbidden-1
Updated
2026-11-02
OSVUSN-2232-1 No score

openssl vulnerabilities

Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS fragments. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0195)

Imre Rad discovered that OpenSSL incorrectly handled DTLS recursions. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2014-0221)

KIKUCHI Masashi discovered that OpenSSL incorrectly handled certain handshakes. A remote attacker could use this flaw to perform a machine-in-the-middle attack and possibly decrypt and modify traffic. (CVE-2014-0224)

Felix Gröbert and Ivan Fratrić discovered that OpenSSL incorrectly handled anonymous ECDH ciphersuites. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-3470)

Record
USN-2232-1
Updated
2026-11-02

Affected products

Show 4 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 1.0.1h-1
1.0.1h-1
openssl
Debian:13
 before 1.0.1h-1
1.0.1h-1
openssl
Debian:14
 before 1.0.1h-1
1.0.1h-1
openssl
Debian:6.0
From an advisory covering 5 CVEs
 before 0.9.8o-4squeeze15, plus listed versions
0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13
Show 9 moreShow less
0.9.8o-4squeeze140.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9
0.9.8o-4squeeze15
openssl
Debian:6.0
From an advisory covering 2 CVEs
 before 0.9.8o-4squeeze16, plus listed versions
0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13
Show 10 moreShow less
0.9.8o-4squeeze140.9.8o-4squeeze150.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9
0.9.8o-4squeeze16
openssl
Debian:7
From an advisory covering 4 CVEs
 before 1.0.1e-2+deb7u10, plus listed versions
1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u4
Show 5 moreShow less
1.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9
1.0.1e-2+deb7u10
openssl
Mageia:3
From an advisory covering 4 CVEs
 before 1.0.1e-1.9.mga3
1.0.1e-1.9.mga3
openssl
Mageia:4
From an advisory covering 4 CVEs
 before 1.0.1e-8.6.mga4
1.0.1e-8.6.mga4
openssl
Red Hat:enterprise_linux:5::client
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
openssl-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
Show 170 moreShow less
Affected packages
PackageAffectedFixed
openssl-perl
Red Hat:enterprise_linux:5::client
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
openssl
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
openssl-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
openssl-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
openssl
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
openssl-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
openssl-devel
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
openssl-perl
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-27.el5_10.3
0:0.9.8e-27.el5_10.3
openssl
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl097a
Red Hat:enterprise_linux:5::client
 before 0:0.9.7a-12.el5_10.1
0:0.9.7a-12.el5_10.1
openssl097a-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.9.7a-12.el5_10.1
0:0.9.7a-12.el5_10.1
openssl097a
Red Hat:enterprise_linux:5::server
 before 0:0.9.7a-12.el5_10.1
0:0.9.7a-12.el5_10.1
openssl097a-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.9.7a-12.el5_10.1
0:0.9.7a-12.el5_10.1
openssl098e
Red Hat:enterprise_linux:6::client
 before 0:0.9.8e-18.el6_5.2
0:0.9.8e-18.el6_5.2
openssl098e-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:0.9.8e-18.el6_5.2
0:0.9.8e-18.el6_5.2
openssl098e
Red Hat:enterprise_linux:6::computenode
 before 0:0.9.8e-18.el6_5.2
0:0.9.8e-18.el6_5.2
openssl098e-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:0.9.8e-18.el6_5.2
0:0.9.8e-18.el6_5.2
openssl098e
Red Hat:enterprise_linux:6::server
 before 0:0.9.8e-18.el6_5.2
0:0.9.8e-18.el6_5.2
openssl098e-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:0.9.8e-18.el6_5.2
0:0.9.8e-18.el6_5.2
openssl098e
Red Hat:enterprise_linux:6::workstation
 before 0:0.9.8e-18.el6_5.2
0:0.9.8e-18.el6_5.2
openssl098e-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:0.9.8e-18.el6_5.2
0:0.9.8e-18.el6_5.2
openssl
Red Hat:rhel_els:4::as
 before 0:0.9.7a-43.22.el4
0:0.9.7a-43.22.el4
openssl-debuginfo
Red Hat:rhel_els:4::as
 before 0:0.9.7a-43.22.el4
0:0.9.7a-43.22.el4
openssl-devel
Red Hat:rhel_els:4::as
 before 0:0.9.7a-43.22.el4
0:0.9.7a-43.22.el4
openssl-perl
Red Hat:rhel_els:4::as
 before 0:0.9.7a-43.22.el4
0:0.9.7a-43.22.el4
openssl
Red Hat:rhel_els:4::es
 before 0:0.9.7a-43.22.el4
0:0.9.7a-43.22.el4
openssl-debuginfo
Red Hat:rhel_els:4::es
 before 0:0.9.7a-43.22.el4
0:0.9.7a-43.22.el4
openssl-devel
Red Hat:rhel_els:4::es
 before 0:0.9.7a-43.22.el4
0:0.9.7a-43.22.el4
openssl-perl
Red Hat:rhel_els:4::es
 before 0:0.9.7a-43.22.el4
0:0.9.7a-43.22.el4
openssl
Red Hat:rhel_mission_critical:5.6
 before 0:0.9.8e-12.el5_6.12
0:0.9.8e-12.el5_6.12
openssl-debuginfo
Red Hat:rhel_mission_critical:5.6
 before 0:0.9.8e-12.el5_6.12
0:0.9.8e-12.el5_6.12
openssl-devel
Red Hat:rhel_mission_critical:5.6
 before 0:0.9.8e-12.el5_6.12
0:0.9.8e-12.el5_6.12
openssl-perl
Red Hat:rhel_mission_critical:5.6
 before 0:0.9.8e-12.el5_6.12
0:0.9.8e-12.el5_6.12
openssl
Red Hat:rhel_eus:5.9
 before 0:0.9.8e-26.el5_9.4
0:0.9.8e-26.el5_9.4
openssl-debuginfo
Red Hat:rhel_eus:5.9
 before 0:0.9.8e-26.el5_9.4
0:0.9.8e-26.el5_9.4
openssl-devel
Red Hat:rhel_eus:5.9
 before 0:0.9.8e-26.el5_9.4
0:0.9.8e-26.el5_9.4
openssl-perl
Red Hat:rhel_eus:5.9
 before 0:0.9.8e-26.el5_9.4
0:0.9.8e-26.el5_9.4
openssl
Red Hat:rhel_eus:6.3::computenode
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl-debuginfo
Red Hat:rhel_eus:6.3::computenode
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl
Red Hat:rhel_eus:6.4::computenode
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl-debuginfo
Red Hat:rhel_eus:6.4::computenode
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl-devel
Red Hat:rhel_eus:6.3::computenode
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl-perl
Red Hat:rhel_eus:6.3::computenode
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl-static
Red Hat:rhel_eus:6.3::computenode
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl-devel
Red Hat:rhel_eus:6.4::computenode
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl-perl
Red Hat:rhel_eus:6.4::computenode
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl-static
Red Hat:rhel_eus:6.4::computenode
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl
Red Hat:rhel_mission_critical:6.2::server
 before 0:1.0.0-20.el6_2.7
0:1.0.0-20.el6_2.7
openssl-debuginfo
Red Hat:rhel_mission_critical:6.2::server
 before 0:1.0.0-20.el6_2.7
0:1.0.0-20.el6_2.7
openssl-devel
Red Hat:rhel_mission_critical:6.2::server
 before 0:1.0.0-20.el6_2.7
0:1.0.0-20.el6_2.7
openssl
Red Hat:rhel_eus:6.3::server
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl-debuginfo
Red Hat:rhel_eus:6.3::server
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl-devel
Red Hat:rhel_eus:6.3::server
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl
Red Hat:rhel_eus:6.4::server
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl-debuginfo
Red Hat:rhel_eus:6.4::server
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl-devel
Red Hat:rhel_eus:6.4::server
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl-perl
Red Hat:rhel_mission_critical:6.2::server
 before 0:1.0.0-20.el6_2.7
0:1.0.0-20.el6_2.7
openssl-static
Red Hat:rhel_mission_critical:6.2::server
 before 0:1.0.0-20.el6_2.7
0:1.0.0-20.el6_2.7
openssl-perl
Red Hat:rhel_eus:6.3::server
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl-static
Red Hat:rhel_eus:6.3::server
 before 0:1.0.0-25.el6_3.3
0:1.0.0-25.el6_3.3
openssl-perl
Red Hat:rhel_eus:6.4::server
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl-static
Red Hat:rhel_eus:6.4::server
 before 0:1.0.0-27.el6_4.4
0:1.0.0-27.el6_4.4
openssl
Red Hat:storage:2.1:server:el6
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:storage:2.1:server:el6
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:storage:2.1:server:el6
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:storage:2.1:server:el6
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:storage:2.1:server:el6
From an advisory covering 6 CVEs
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
From an advisory covering 2 CVEs
 before 0:6.5-20140603.1.el6ev
0:6.5-20140603.1.el6ev
openssl
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl098e
Red Hat:enterprise_linux:7::client
 before 0:0.9.8e-29.el7_0.2
0:0.9.8e-29.el7_0.2
openssl098e-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.9.8e-29.el7_0.2
0:0.9.8e-29.el7_0.2
openssl098e
Red Hat:enterprise_linux:7::computenode
 before 0:0.9.8e-29.el7_0.2
0:0.9.8e-29.el7_0.2
openssl098e-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:0.9.8e-29.el7_0.2
0:0.9.8e-29.el7_0.2
openssl098e
Red Hat:enterprise_linux:7::server
 before 0:0.9.8e-29.el7_0.2
0:0.9.8e-29.el7_0.2
openssl098e-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.9.8e-29.el7_0.2
0:0.9.8e-29.el7_0.2
openssl098e
Red Hat:enterprise_linux:7::workstation
 before 0:0.9.8e-29.el7_0.2
0:0.9.8e-29.el7_0.2
openssl098e-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.9.8e-29.el7_0.2
0:0.9.8e-29.el7_0.2
compat-openssl098
SUSE:Linux Enterprise Desktop 12
From an advisory covering 7 CVEs
 before 0.9.8j-70.2
0.9.8j-70.2
compat-openssl098
SUSE:Linux Enterprise Module for Legacy 12
From an advisory covering 7 CVEs
 before 0.9.8j-70.2
0.9.8j-70.2
mariadb
SUSE:Linux Enterprise Desktop 12
From an advisory covering 40 CVEs
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 40 CVEs
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Server 12
From an advisory covering 40 CVEs
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 40 CVEs
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Workstation Extension 12
From an advisory covering 40 CVEs
 before 10.0.16-15.1
10.0.16-15.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 68.2.0-78.51.4
68.2.0-78.51.4
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 68-21.9.8
68-21.9.8
firefox-atk
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.26.1-2.8.4
2.26.1-2.8.4
firefox-cairo
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.15.10-2.13.4
1.15.10-2.13.4
firefox-gdk-pixbuf
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.36.11-2.8.4
2.36.11-2.8.4
firefox-glib2
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.54.3-2.14.7
2.54.3-2.14.7
firefox-gtk3
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.10.9-2.15.3
3.10.9-2.15.3
firefox-harfbuzz
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.7.5-2.7.4
1.7.5-2.7.4
firefox-libffi
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.2.1.git259-2.3.3
3.2.1.git259-2.3.3
firefox-libffi-gcc5
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 5.3.1+r233831-14.1
5.3.1+r233831-14.1
firefox-pango
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.40.14-2.7.4
1.40.14-2.7.4
mozilla-nspr
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 4.21-29.6.1
4.21-29.6.1
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.45-38.9.3
3.45-38.9.3
libqt4
SUSE:Linux Enterprise Desktop 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Desktop 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Desktop 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Desktop 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server 12
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Workstation Extension 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Workstation Extension 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Workstation Extension 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Workstation Extension 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
openssl
Ubuntu:14.04:LTS
 before 1.0.1f-1ubuntu2.2, plus listed versions
1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu41.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.1
1.0.1f-1ubuntu2.2
openssl098
Ubuntu:14.04:LTS
 before 0.9.8o-7ubuntu3.2.14.04.1, plus listed versions
0.9.8o-7ubuntu3.1
0.9.8o-7ubuntu3.2.14.04.1
openssl
Ubuntu:14.04:LTS
From an advisory covering 4 CVEs
 before 1.0.1f-1ubuntu2.2, plus listed versions
1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu41.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.1
1.0.1f-1ubuntu2.2
virtualbox
openSUSE:Tumbleweed
From an advisory covering 19 CVEs
 before 5.1.10-2.5
5.1.10-2.5
openssl-1_1
openSUSE:Tumbleweed
From an advisory covering 136 CVEs
 before 1.1.1l-1.2
1.1.1l-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubTripwire/OpenSSL-CCS-Inject-Test2014-06-12
PoC in GitHubiph0n3/CVE-2014-02242014-07-08
PoC in GitHubdroptables/ccs-eval2014-07-10
PoC in GitHubssllabs/openssl-ccs-cve-2014-02242014-07-15
PoC in GitHubsecretnonempty/CVE-2014-02242014-07-16
MetasploitOpenSSL Server-Side ChangeCipherSpec Injection Scanner2014-06-05

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0224 is a high vulnerability (CVSS 7.4) in Openssl, published August 30, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.3%, the 99th percentile. Fixed in openssl 1.0.1h-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,270 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open