CVE-2015-0204

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p,...

4.3 MediumPublic exploitFix available

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.

Exploit likelihood

98.7%Up 35.3 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2015-0204
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-0204
Updated: 2026-11-02

EUVDEUVD-2015-0241 No score

Record: EUVD-2015-0241
Updated: 2026-11-02

GitHub AdvisoriesGHSA-ff55-77ff-xv8x No score

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p,...

Record: GHSA-ff55-77ff-xv8x
Updated: 2026-11-02

OSVRHSA-2015:0066 5.3

Red Hat Security Advisory: openssl security update

Record: RHSA-2015:0066
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2015:0800 5.3

Red Hat Security Advisory: openssl security update

Record: RHSA-2015:0800
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Show 45 moreShow less

OSV No score

Record: CVE-2015-0204
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-0204 No score

Record: DEBIAN-CVE-2015-0204
Updated: 2026-11-02

OSVMGASA-2015-0022 No score

Updated openssl packages fix security vulnerabilities

A carefully crafted DTLS message can cause a segmentation fault in OpenSSL due to a NULL pointer dereference. This could lead to a Denial Of Service attack (CVE-2014-3571).

A memory leak can occur in the dtls1_buffer_record function under certain conditions. In particular this could occur if an attacker sent repeated DTLS records with the same sequence number but for the next epoch. The memory leak could be exploited by an attacker in a Denial of Service attack through memory exhaustion (CVE-2015-0206).

When openssl is built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl method would be set to NULL which could later result in a NULL pointer dereference (CVE-2014-3569).

An OpenSSL client will accept a handshake using an ephemeral ECDH ciphersuite using an ECDSA certificate if the server key exchange message is omitted. This effectively removes forward secrecy from the ciphersuite (CVE-2014-3572).

An OpenSSL client will accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. A server could present a weak temporary key and downgrade the security of the session (CVE-2015-0204).

An OpenSSL server will accept a DH certificate for client authentication without the certificate verify message. This effectively allows a client to authenticate without the use of a private key. This only affects servers which trust a client certificate authority which issues certificates containing DH keys: these are extremely rare and hardly ever encountered (CVE-2015-0205).

OpenSSL accepts several non-DER-variations of certificate signature algorithm and signature encodings. OpenSSL also does not enforce a match between the signature algorithm between the signed and unsigned portions of the certificate. By modifying the contents of the signature algorithm or the encoding of the signature, it is possible to change the certificate's fingerprint. This does not allow an attacker to forge certificates, and does not affect certificate verification or OpenSSL servers/clients in any other way. It also does not affect common revocation mechanisms. Only custom applications that rely on the uniqueness of the fingerprint (e.g. certificate blacklists) may be affected (CVE-2014-8275).

Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64. This bug occurs at random with a very low probability, and is not known to be exploitable in any way, though its exact impact is difficult to determine (CVE-2014-3570).

The updated packages have been upgraded to the 1.0.1k version where these security flaws have been fixed.

Record: MGASA-2015-0022
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10271-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10529-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11127-1
Updated: 2026-11-02

OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

Introduce venv-salt-minion.
Mention fixed issues provided with the bundle.

Record: SUSE-FU-2022:0445-1
Updated: 2026-11-02

OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-RU-2015:0769-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0182-2 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

Record: SUSE-SU-2015:0182-2
Updated: 2026-11-02

OSVSUSE-SU-2015:0305-1 No score

Security update for compat-openssl098

The openssl 0.9.8j compatibility package was updated to fix several security vulnerabilities:

CVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64.

CVE-2014-3571: Fix crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record.

CVE-2014-3572: Do not accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted.

CVE-2014-8275: Fixed various certificate fingerprint issues

CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites

CVE-2015-0205: OpenSSL 0.9.8j is NOT vulnerable to CVE-2015-0205 as it doesn't support DH certificates and this typo prohibits skipping of certificate verify message for sign only certificates anyway. (This patch only fixes the wrong condition)

This update also fixes regression caused by CVE-2014-0224.patch (bnc#892403)

Record: SUSE-SU-2015:0305-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0343-1 No score

Security update for IBM Java

java-1_7_0-ibm has been updated to version 1.7.0_sr7.2 to fix 21 security issues.

These security issues have been fixed:

* Unspecified vulnerability (CVE-2014-3065).
* The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
  products, uses nondeterministic CBC padding, which makes it easier
  for man-in-the-middle attackers to obtain cleartext data via a
  padding-oracle attack, aka the 'POODLE' issue (CVE-2014-3566).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and
  Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to
  AWT (CVE-2014-6513).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors (CVE-2014-6456).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532
  (CVE-2014-6503).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503
  (CVE-2014-6532).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-4288).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-6493).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Firefox, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6492).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows local users to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment
  (CVE-2014-6458).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Internet Explorer, allows local users to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6466).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Libraries (CVE-2014-6506).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect integrity via unknown vectors related to
  Deployment, a different vulnerability than CVE-2014-6527
  (CVE-2014-6476).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect integrity via unknown vectors
  related to Deployment (CVE-2014-6515).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20 allows remote attackers to affect confidentiality via unknown
  vectors related to 2D (CVE-2014-6511).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality via unknown vectors related to Libraries
  (CVE-2014-6531).
* Unspecified…

Record: SUSE-SU-2015:0343-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0343-2 No score

Security update for IBM Java

java-1_6_0-ibm has been updated to version 1.6.0_sr16.2 to fix 18 security issues.

These security issues have been fixed:

* Unspecified vulnerability in Oracle Java SE 6u81 (CVE-2014-3065).
* The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
  products, uses nondeterministic CBC padding, which makes it easier
  for man-in-the-middle attackers to obtain cleartext data via a
  padding-oracle attack, aka the 'POODLE' issue (CVE-2014-3566).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and
  Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to
  AWT (CVE-2014-6513).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532
  (CVE-2014-6503).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503
  (CVE-2014-6532).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-4288).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-6493).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Firefox, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6492).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows local users to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment
  (CVE-2014-6458).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Internet Explorer, allows local users to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6466).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Libraries (CVE-2014-6506).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect integrity via unknown vectors
  related to Deployment (CVE-2014-6515).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20 allows remote attackers to affect confidentiality via unknown
  vectors related to 2D (CVE-2014-6511).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality via unknown vectors related to Libraries
  (CVE-2014-6531).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows
  remote attackers to affect integrity via unknown vectors related to
  Libraries (CVE-2014-6512).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows
  remote…

Record: SUSE-SU-2015:0343-2
Updated: 2026-11-02

OSVSUSE-SU-2015:0344-1 No score

Security update for IBM Java 7

IBM Java 7 SR6 has been released and fixes lots of bugs and security issues.

More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ http://www.ibm.com/developerworks/java/jdk/alerts/

Security Issue references:

* CVE-2013-5458
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5458>
* CVE-2013-5456
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5456>
* CVE-2013-5457
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5457>
* CVE-2013-4041
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4041>
* CVE-2013-5375
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5375>
* CVE-2013-5372
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5372>
* CVE-2013-5843
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5843>
* CVE-2013-5789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5789>
* CVE-2013-5830
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5830>
* CVE-2013-5829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5829>
* CVE-2013-5787
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5787>
* CVE-2013-5788
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5788>
* CVE-2013-5824
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5824>
* CVE-2013-5842
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5842>
* CVE-2013-5782
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5782>
* CVE-2013-5817
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5817>
* CVE-2013-5809
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5809>
* CVE-2013-5814
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5814>
* CVE-2013-5832
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5832>
* CVE-2013-5850
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5850>
* CVE-2013-5838
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5838>
* CVE-2013-5802
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5802>
* CVE-2013-5812
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5812>
* CVE-2013-5804
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5804>
* CVE-2013-5783
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5783>
* CVE-2013-3829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3829>
* CVE-2013-5823
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5823>
* CVE-2013-5831
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5831>
* CVE-2013-5820
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5820>
* CVE-2013-5819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5819>
* CVE-2013-5818
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5818>
* CVE-2013-5848
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5848>
* CVE-2013-5776
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5776>
* CVE-2013-5774
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5774>
* CVE-2013-5825
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5825>
* CVE-2013-5840
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5840>
* CVE-2013-5801
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5801>
* CVE-2013-5778
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5778>
* CVE-2013-5851
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5851>
* CVE-2013-5800
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5800>
* CVE-2013-5784
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5784>
* CVE-2013-5849
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5849>
* CVE-2013-5790
 …

Record: SUSE-SU-2015:0344-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0392-1 No score

Security update for IBM Java 6

IBM Java 6 SR15 has been released and fixes lots of bugs and security issues.

More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ http://www.ibm.com/developerworks/java/jdk/alerts/

Security Issue references:

* CVE-2013-5458
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5458>
* CVE-2013-5456
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5456>
* CVE-2013-5457
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5457>
* CVE-2013-4041
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4041>
* CVE-2013-5375
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5375>
* CVE-2013-5372
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5372>
* CVE-2013-5843
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5843>
* CVE-2013-5789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5789>
* CVE-2013-5830
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5830>
* CVE-2013-5829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5829>
* CVE-2013-5787
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5787>
* CVE-2013-5788
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5788>
* CVE-2013-5824
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5824>
* CVE-2013-5842
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5842>
* CVE-2013-5782
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5782>
* CVE-2013-5817
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5817>
* CVE-2013-5809
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5809>
* CVE-2013-5814
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5814>
* CVE-2013-5832
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5832>
* CVE-2013-5850
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5850>
* CVE-2013-5838
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5838>
* CVE-2013-5802
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5802>
* CVE-2013-5812
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5812>
* CVE-2013-5804
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5804>
* CVE-2013-5783
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5783>
* CVE-2013-3829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3829>
* CVE-2013-5823
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5823>
* CVE-2013-5831
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5831>
* CVE-2013-5820
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5820>
* CVE-2013-5819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5819>
* CVE-2013-5818
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5818>
* CVE-2013-5848
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5848>
* CVE-2013-5776
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5776>
* CVE-2013-5774
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5774>
* CVE-2013-5825
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5825>
* CVE-2013-5840
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5840>
* CVE-2013-5801
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5801>
* CVE-2013-5778
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5778>
* CVE-2013-5851
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5851>
* CVE-2013-5800
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5800>
* CVE-2013-5784
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5784>
* CVE-2013-5849
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5849>
* CVE-2013-5790
 …

Record: SUSE-SU-2015:0392-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0543-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

Record: SUSE-SU-2015:0543-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0545-1 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>

Record: SUSE-SU-2015:0545-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0545-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:0545-2
Updated: 2026-11-02

OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:0546-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0547-1 No score

Security update for compat-openssl097g

OpenSSL was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
  rejecting connections with DH parameters shorter than 1024 bits.
  2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
  was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
  This will only get active if applications get rebuilt and actually
  use this string. (bsc#931698)

Security Issues:

* CVE-2015-1789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>

Record: SUSE-SU-2015:0547-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0578-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

Record: SUSE-SU-2015:0578-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0620-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>

Record: SUSE-SU-2015:0620-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0946-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>

Record: SUSE-SU-2015:0946-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1086-1 No score

Security update for IBM Java 6

IBM Java 6 SR15 has been released and fixes lots of bugs and security issues.

More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ http://www.ibm.com/developerworks/java/jdk/alerts/

Security Issue references:

* CVE-2013-5458
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5458>
* CVE-2013-5456
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5456>
* CVE-2013-5457
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5457>
* CVE-2013-4041
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4041>
* CVE-2013-5375
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5375>
* CVE-2013-5372
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5372>
* CVE-2013-5843
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5843>
* CVE-2013-5789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5789>
* CVE-2013-5830
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5830>
* CVE-2013-5829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5829>
* CVE-2013-5787
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5787>
* CVE-2013-5788
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5788>
* CVE-2013-5824
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5824>
* CVE-2013-5842
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5842>
* CVE-2013-5782
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5782>
* CVE-2013-5817
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5817>
* CVE-2013-5809
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5809>
* CVE-2013-5814
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5814>
* CVE-2013-5832
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5832>
* CVE-2013-5850
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5850>
* CVE-2013-5838
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5838>
* CVE-2013-5802
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5802>
* CVE-2013-5812
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5812>
* CVE-2013-5804
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5804>
* CVE-2013-5783
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5783>
* CVE-2013-3829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3829>
* CVE-2013-5823
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5823>
* CVE-2013-5831
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5831>
* CVE-2013-5820
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5820>
* CVE-2013-5819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5819>
* CVE-2013-5818
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5818>
* CVE-2013-5848
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5848>
* CVE-2013-5776
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5776>
* CVE-2013-5774
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5774>
* CVE-2013-5825
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5825>
* CVE-2013-5840
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5840>
* CVE-2013-5801
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5801>
* CVE-2013-5778
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5778>
* CVE-2013-5851
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5851>
* CVE-2013-5800
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5800>
* CVE-2013-5784
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5784>
* CVE-2013-5849
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5849>
* CVE-2013-5790
 …

Record: SUSE-SU-2015:1086-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1086-2 No score

Security update for IBM Java

java-1_6_0-ibm has been updated to version 1.6.0_sr16.2 to fix 18 security issues.

These security issues has been fixed:

* Unspecified vulnerability in Oracle Java SE 6u81 (CVE-2014-3065).
* The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
  products, uses nondeterministic CBC padding, which makes it easier
  for man-in-the-middle attackers to obtain cleartext data via a
  padding-oracle attack, aka the 'POODLE' issue (CVE-2014-3566).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and
  Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to
  AWT (CVE-2014-6513).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532
  (CVE-2014-6503).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503
  (CVE-2014-6532).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-4288).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-6493).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Firefox, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6492).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows local users to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment
  (CVE-2014-6458).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Internet Explorer, allows local users to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6466).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Libraries (CVE-2014-6506).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect integrity via unknown vectors
  related to Deployment (CVE-2014-6515).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20 allows remote attackers to affect confidentiality via unknown
  vectors related to 2D (CVE-2014-6511).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality via unknown vectors related to Libraries
  (CVE-2014-6531).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows
  remote attackers to affect integrity via unknown vectors related to
  Libraries (CVE-2014-6512).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows
  remote…

Record: SUSE-SU-2015:1086-2
Updated: 2026-11-02

OSVSUSE-SU-2015:1086-3 No score

Security update for IBM Java 7

IBM Java 7 SR6 has been released and fixes lots of bugs and security issues.

More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ http://www.ibm.com/developerworks/java/jdk/alerts/

Security Issue references:

* CVE-2013-5458
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5458>
* CVE-2013-5456
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5456>
* CVE-2013-5457
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5457>
* CVE-2013-4041
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4041>
* CVE-2013-5375
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5375>
* CVE-2013-5372
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5372>
* CVE-2013-5843
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5843>
* CVE-2013-5789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5789>
* CVE-2013-5830
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5830>
* CVE-2013-5829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5829>
* CVE-2013-5787
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5787>
* CVE-2013-5788
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5788>
* CVE-2013-5824
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5824>
* CVE-2013-5842
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5842>
* CVE-2013-5782
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5782>
* CVE-2013-5817
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5817>
* CVE-2013-5809
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5809>
* CVE-2013-5814
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5814>
* CVE-2013-5832
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5832>
* CVE-2013-5850
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5850>
* CVE-2013-5838
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5838>
* CVE-2013-5802
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5802>
* CVE-2013-5812
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5812>
* CVE-2013-5804
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5804>
* CVE-2013-5783
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5783>
* CVE-2013-3829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3829>
* CVE-2013-5823
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5823>
* CVE-2013-5831
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5831>
* CVE-2013-5820
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5820>
* CVE-2013-5819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5819>
* CVE-2013-5818
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5818>
* CVE-2013-5848
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5848>
* CVE-2013-5776
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5776>
* CVE-2013-5774
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5774>
* CVE-2013-5825
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5825>
* CVE-2013-5840
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5840>
* CVE-2013-5801
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5801>
* CVE-2013-5778
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5778>
* CVE-2013-5851
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5851>
* CVE-2013-5800
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5800>
* CVE-2013-5784
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5784>
* CVE-2013-5849
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5849>
* CVE-2013-5790
 …

Record: SUSE-SU-2015:1086-3
Updated: 2026-11-02

OSVSUSE-SU-2015:1086-4 No score

Security update for IBM Java

java-1_7_0-ibm has been updated to version 1.7.0_sr7.2 to fix 21 security issues.

These security issues have been fixed:

* Unspecified vulnerability (CVE-2014-3065).
* The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
  products, uses nondeterministic CBC padding, which makes it easier
  for man-in-the-middle attackers to obtain cleartext data via a
  padding-oracle attack, aka the 'POODLE' issue (CVE-2014-3566).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and
  Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via vectors related to
  AWT (CVE-2014-6513).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors (CVE-2014-6456).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532
  (CVE-2014-6503).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503
  (CVE-2014-6532).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-4288).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment, a different
  vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532
  (CVE-2014-6493).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Firefox, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6492).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows local users to affect confidentiality, integrity, and
  availability via unknown vectors related to Deployment
  (CVE-2014-6458).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,
  when running on Internet Explorer, allows local users to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Deployment (CVE-2014-6466).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality, integrity, and availability via unknown vectors
  related to Libraries (CVE-2014-6506).
* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows
  remote attackers to affect integrity via unknown vectors related to
  Deployment, a different vulnerability than CVE-2014-6527
  (CVE-2014-6476).
* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20
  allows remote attackers to affect integrity via unknown vectors
  related to Deployment (CVE-2014-6515).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20 allows remote attackers to affect confidentiality via unknown
  vectors related to 2D (CVE-2014-6511).
* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and
  8u20, and Java SE Embedded 7u60, allows remote attackers to affect
  confidentiality via unknown vectors related to Libraries
  (CVE-2014-6531).
* Unspecified…

Record: SUSE-SU-2015:1086-4
Updated: 2026-11-02

OSVSUSE-SU-2015:1161-1 No score

Security update for java-1_6_0-ibm

IBM Java 1.6.0 was updated to SR16-FP4 fixing security issues and bugs.

Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_2015

CVEs addressed: CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204

Additional bugs fixed:

Fix javaws/plugin stuff should slave plugin update-alternatives (bnc#912434)
Changed Java to use the system root CA certificates (bnc#912447)

Record: SUSE-SU-2015:1161-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1177-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>

Record: SUSE-SU-2015:1177-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1182-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:1182-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1182-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:1182-2
Updated: 2026-11-02

OSVSUSE-SU-2015:1183-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>

Record: SUSE-SU-2015:1183-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1183-2 No score

Security update for compat-openssl097g

OpenSSL was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
  rejecting connections with DH parameters shorter than 1024 bits.
  2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
  was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
  This will only get active if applications get rebuilt and actually
  use this string. (bsc#931698)

Security Issues:

* CVE-2015-1789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>

Record: SUSE-SU-2015:1183-2
Updated: 2026-11-02

OSVSUSE-SU-2015:1184-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:1184-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1184-2 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>

Record: SUSE-SU-2015:1184-2
Updated: 2026-11-02

OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:1185-1
Updated: 2026-11-02

OSVSUSE-SU-2015:2166-1 No score

Security update for java-1_6_0-ibm

This update for java-1_6_0-ibm fixes the following issues:

Version update to 6.0-16.15 bsc#955131: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006

CVE-2015-2808 CVE-2015-2625 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204

Record: SUSE-SU-2015:2166-1
Updated: 2026-11-02

OSVSUSE-SU-2015:2168-1 No score

Security update for java-1_7_1-ibm

The java-1_7_1-ibm package was updated to versioin 7.1-3.20 to fix several security and non security issues:

bnc#955131: Version update to 7.1-3.20: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006
Add backcompat symlinks for sdkdir
bnc#941939: Fix to provide %{name} instead of %{sdklnk} only in _jvmprivdir

Record: SUSE-SU-2015:2168-1
Updated: 2026-11-02

OSVSUSE-SU-2015:2168-2 No score

Security update for java-1_7_1-ibm

The java-1_7_1-ibm package was updated to versioin 7.1-3.20 to fix several security and non security issues:

bnc#955131: Version update to 7.1-3.20: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006
Add backcompat symlinks for sdkdir
bnc#941939: Fix to provide %{name} instead of %{sdklnk} only in _jvmprivdir

Record: SUSE-SU-2015:2168-2
Updated: 2026-11-02

OSVSUSE-SU-2015:2182-1 No score

Security update for java-1_7_1-ibm

The java-1_7_1-ibm package was updated to version 7.1-3.20 to fix several security and non security issues:

bnc#955131: Version update to 7.1-3.20: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006
Add backcompat symlinks for sdkdir
bnc#941939: Fix to provide %{name} instead of %{sdklnk} only in _jvmprivdir

Record: SUSE-SU-2015:2182-1
Updated: 2026-11-02

OSVSUSE-SU-2015:2192-1 No score

Security update for java-1_6_0-ibm

This update for java-1_6_0-ibm fixes the following issues:

Version update to 6.0-16.15 bsc#955131: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 CVE-2015-2808 CVE-2015-2625 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204
Add backcompat symlinks for sdkdir
Fix baselibs.conf policy symlinking
Fix bsc#941939 to provide %{name} instead of %{sdklnk} only in _jvmprivdir

Record: SUSE-SU-2015:2192-1
Updated: 2026-11-02

OSVSUSE-SU-2015:2216-1 No score

Security update for java-1_7_0-ibm

The java-1_7_0-ibm package was updated to version 7.0-9.20 to fix several security and non security issues:

bnc#955131: Version update to 7.0-9.20: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006
Add backcompat symlinks for sdkdir
bnc#941939: Fix to provide %{name} instead of %{sdklnk} only in _jvmprivdir

Record: SUSE-SU-2015:2216-1
Updated: 2026-11-02

OSVSUSE-SU-403 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-403
Updated: 2026-11-02

OSVSUSE-SU-403 Forbidden-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-403 Forbidden-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-0204 No score

Record: UBUNTU-CVE-2015-0204
Updated: 2026-11-02

OSVUSN-2459-1 No score

openssl vulnerabilities

Pieter Wuille discovered that OpenSSL incorrectly handled Bignum squaring. (CVE-2014-3570)

Markus Stenberg discovered that OpenSSL incorrectly handled certain crafted DTLS messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2014-3571)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled certain handshakes. A remote attacker could possibly use this issue to downgrade to ECDH, removing forward secrecy from the ciphersuite. (CVE-2014-3572)

Antti Karjalainen, Tuomo Untinen and Konrad Kraszewski discovered that OpenSSL incorrectly handled certain certificate fingerprints. A remote attacker could possibly use this issue to trick certain applications that rely on the uniqueness of fingerprints. (CVE-2014-8275)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled certain key exchanges. A remote attacker could possibly use this issue to downgrade the security of the session to EXPORT_RSA. (CVE-2015-0204)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled client authentication. A remote attacker could possibly use this issue to authenticate without the use of a private key in certain limited scenarios. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0205)

Chris Mueller discovered that OpenSSL incorrect handled memory when processing DTLS records. A remote attacker could use this issue to cause OpenSSL to consume resources, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0206)

Record: USN-2459-1
Updated: 2026-11-02

Affected products

openssl

Affected packages

Affected packages
Package	Affected	Fixed
`openssl` Debian:12	before 1.0.1k-1	1.0.1k-1
`openssl` Debian:13	before 1.0.1k-1	1.0.1k-1
`openssl` Debian:14	before 1.0.1k-1	1.0.1k-1
`openssl` Debian:6.0 From an advisory covering 5 CVEs	before 0.9.8o-4squeeze19, plus listed versions 0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13 Show 13 moreShow less 0.9.8o-4squeeze140.9.8o-4squeeze150.9.8o-4squeeze160.9.8o-4squeeze170.9.8o-4squeeze180.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9	0.9.8o-4squeeze19
`openssl` Debian:7 From an advisory covering 8 CVEs	before 1.0.1e-2+deb7u14, plus listed versions 1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u101.0.1e-2+deb7u111.0.1e-2+deb7u12 Show 9 moreShow less 1.0.1e-2+deb7u131.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9	1.0.1e-2+deb7u14
`openssl` Mageia:4 From an advisory covering 9 CVEs	before 1.0.1k-1.mga4	1.0.1k-1.mga4
`openssl` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-debuginfo` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-devel` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-perl` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5

Show 102 moreShow less

Affected packages
Package	Affected	Fixed
`openssl-static` Red Hat:enterprise_linux:6::client From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-debuginfo` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-devel` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-perl` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-static` Red Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-debuginfo` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-devel` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-perl` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-static` Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-debuginfo` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-devel` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-perl` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl-static` Red Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs	before 0:1.0.1e-30.el6_6.5	0:1.0.1e-30.el6_6.5
`openssl` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-libs` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-devel` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-perl` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-static` Red Hat:enterprise_linux:7::client From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-libs` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-devel` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-perl` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-static` Red Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-devel` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-libs` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-perl` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-static` Red Hat:enterprise_linux:7::server From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-devel` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-libs` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-perl` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl-static` Red Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs	before 1:1.0.1e-34.el7_0.7	1:1.0.1e-34.el7_0.7
`openssl` Red Hat:enterprise_linux:5::client From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`openssl-debuginfo` Red Hat:enterprise_linux:5::client From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`openssl-perl` Red Hat:enterprise_linux:5::client From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`openssl` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`openssl-debuginfo` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`openssl-devel` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`openssl` Red Hat:enterprise_linux:5::server From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`openssl-debuginfo` Red Hat:enterprise_linux:5::server From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`openssl-devel` Red Hat:enterprise_linux:5::server From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`openssl-perl` Red Hat:enterprise_linux:5::server From an advisory covering 9 CVEs	before 0:0.9.8e-33.el5_11	0:0.9.8e-33.el5_11
`compat-openssl098` SUSE:Linux Enterprise Desktop 12 From an advisory covering 7 CVEs	before 0.9.8j-70.2	0.9.8j-70.2
`compat-openssl098` SUSE:Linux Enterprise Module for Legacy 12 From an advisory covering 7 CVEs	before 0.9.8j-70.2	0.9.8j-70.2
`java-1_6_0-ibm` SUSE:Linux Enterprise Module for Legacy 12 From an advisory covering 13 CVEs	before 1.6.0_sr16.4-15.1	1.6.0_sr16.4-15.1
`java-1_6_0-ibm` SUSE:Linux Enterprise Software Development Kit 11 SP3 From an advisory covering 31 CVEs	before 1.6.0_sr16.15-46.1	1.6.0_sr16.15-46.1
`java-1_6_0-ibm` SUSE:Linux Enterprise Server 11 SP2-LTSS From an advisory covering 31 CVEs	before 1.6.0_sr16.15-46.1	1.6.0_sr16.15-46.1
`java-1_6_0-ibm` SUSE:Linux Enterprise Server 11 SP3 From an advisory covering 31 CVEs	before 1.6.0_sr16.15-46.1	1.6.0_sr16.15-46.1
`java-1_6_0-ibm` SUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 31 CVEs	before 1.6.0_sr16.15-46.1	1.6.0_sr16.15-46.1
`java-1_6_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 11 SP3 From an advisory covering 31 CVEs	before 1.6.0_sr16.15-46.1	1.6.0_sr16.15-46.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 29 CVEs	before 1.7.1_sr3.20-18.1	1.7.1_sr3.20-18.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 12 From an advisory covering 29 CVEs	before 1.7.1_sr3.20-18.1	1.7.1_sr3.20-18.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 29 CVEs	before 1.7.1_sr3.20-18.1	1.7.1_sr3.20-18.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 29 CVEs	before 1.7.1_sr3.20-18.1	1.7.1_sr3.20-18.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 29 CVEs	before 1.7.1_sr3.20-18.1	1.7.1_sr3.20-18.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 29 CVEs	before 1.7.1_sr3.20-18.1	1.7.1_sr3.20-18.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 29 CVEs	before 1.7.1_sr3.20-6.1	1.7.1_sr3.20-6.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 11 SP4 From an advisory covering 29 CVEs	before 1.7.1_sr3.20-6.1	1.7.1_sr3.20-6.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 29 CVEs	before 1.7.1_sr3.20-6.1	1.7.1_sr3.20-6.1
`java-1_6_0-ibm` SUSE:Linux Enterprise Module for Legacy 12 From an advisory covering 31 CVEs	before 1.6.0_sr16.15-27.1	1.6.0_sr16.15-27.1
`java-1_7_0-ibm` SUSE:Linux Enterprise Software Development Kit 11 SP3 From an advisory covering 29 CVEs	before 1.7.0_sr9.20-42.1	1.7.0_sr9.20-42.1
`java-1_7_0-ibm` SUSE:Linux Enterprise Server 11 SP2-LTSS From an advisory covering 29 CVEs	before 1.7.0_sr9.20-42.1	1.7.0_sr9.20-42.1
`java-1_7_0-ibm` SUSE:Linux Enterprise Server 11 SP3 From an advisory covering 29 CVEs	before 1.7.0_sr9.20-42.1	1.7.0_sr9.20-42.1
`java-1_7_0-ibm` SUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 29 CVEs	before 1.7.0_sr9.20-42.1	1.7.0_sr9.20-42.1
`java-1_7_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 11 SP3 From an advisory covering 29 CVEs	before 1.7.0_sr9.20-42.1	1.7.0_sr9.20-42.1
`libqt4` SUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-sql-plugins` SUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-sql-plugins` SUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-devel-doc` SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.3	4.8.6-7.3
`libqt4-sql-plugins` SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-sql-plugins` SUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4` SUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`libqt4-sql-plugins` SUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs	before 4.8.6-7.1	4.8.6-7.1
`openssl` Ubuntu:14.04:LTS	before 1.0.1f-1ubuntu2.8, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 8 moreShow less 1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.7	1.0.1f-1ubuntu2.8
`openssl` Ubuntu:14.04:LTS From an advisory covering 7 CVEs	before 1.0.1f-1ubuntu2.8, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 8 moreShow less 1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.7	1.0.1f-1ubuntu2.8
`openssl-1_1` openSUSE:Tumbleweed From an advisory covering 136 CVEs	before 1.1.1l-1.2	1.1.1l-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	felmoltor/FreakVulnChecker	2015-03-04
PoC in GitHub	scottjpack/Freak-Scanner	2015-03-05
PoC in GitHub	AbhishekGhosh/FREAK-Attack-CVE-2015-0204-Testing-Script	2015-03-06
PoC in GitHub	niccoX/patch-openssl-CVE-2014-0291_CVE-2015-0204	2015-03-23
PoC in GitHub	anthophilee/A2SV--SSL-VUL-Scan	2021-01-01

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0204 is a medium vulnerability (CVSS 4.3) in Openssl, published August 30, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.7%, the 99th percentile. Fixed in openssl 1.0.1k-1.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 1,192 references and the rest of 8 source descriptions. The JSON record has them.