CVE-2015-0286
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r...
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
Exploit likelihood
What each source reports
NVD Score used
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
- Record
CVE-2015-0286- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-17
- Updated
- 2026-11-02
CVE List No score
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
- Record
CVE-2015-0286- Updated
- 2026-11-02
EUVDEUVD-2015-0299 No score
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
- Record
EUVD-2015-0299- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-77f5-q9w4-mgwj No score
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r...
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
- Record
GHSA-77f5-q9w4-mgwj- Updated
- 2026-11-02
OSVBELL-CVE-2015-0286
CVE-2015-0286 does not affect BellSoft software
- Record
BELL-CVE-2015-0286- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSV No score
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
- Record
CVE-2015-0286- Updated
- 2026-11-02
Show 31 moreShow less
OSVDEBIAN-CVE-2015-0286 No score
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
- Record
DEBIAN-CVE-2015-0286- Updated
- 2026-11-02
OSVMGASA-2015-0111 No score
Updated openssl packages fix security vulnerabilities
Updated openssl packages fix security vulnerabilities:
The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check certificate signature algorithm consistency this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication (CVE-2015-0286).
Reusing a structure in ASN.1 parsing may allow an attacker to cause memory corruption via an invalid write. Such reuse is and has been strongly discouraged and is believed to be rare. Certificate parsing, OpenSSL clients, and OpenSSL servers are not affected (CVE-2015-0287).
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. OpenSSL clients and servers are not affected (CVE-2015-0289).
A malicious client can trigger an OPENSSL_assert (i.e., an abort) in servers that both support SSLv2 and enable export cipher suites by sending a specially crafted SSLv2 CLIENT-MASTER-KEY message (CVE-2015-0293).
A malformed EC private key file consumed via the d2i_ECPrivateKey function could cause a use after free condition. This, in turn, could cause a double free in several private key parsing functions (such as d2i_PrivateKey or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption for applications that receive EC private keys from untrusted sources. This scenario is considered rare (CVE-2015-0209).
The function X509_to_X509_REQ will crash with a NULL pointer dereference if the certificate key is invalid. This function is rarely used in practice (CVE-2015-0288).
- Record
MGASA-2015-0111- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10200-1 No score
libmysql56client18-32bit-5.6.34-1.1 on GA media
These are all security issues fixed in the libmysql56client18-32bit-5.6.34-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10200-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score
libopenssl-devel-1.0.2j-2.2 on GA media
These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10271-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10309-1 No score
libcrypto38-2.5.0-1.1 on GA media
These are all security issues fixed in the libcrypto38-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10309-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score
libopenssl1_0_0-steam-1.0.2h-4.1 on GA media
These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10529-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score
libopenssl-1_1-devel-1.1.1l-1.2 on GA media
These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11127-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
OSVSUSE-RU-2015:0769-1 No score
Security update for openssl1
This OpenSSL update fixes the following issues:
* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3513
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-RU-2015:0769-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0182-2 No score
Security update for compat-openssl097g
This compat-openssl097g rollup update contains various security fixes:
* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
can result in memory corruption during buffer management operations.
Security Issue reference:
* CVE-2012-2110
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
- Record
SUSE-SU-2015:0182-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:0541-1 No score
Security update for openssl
OpenSSL was updated to fix various security issues.
Following security issues were fixed:
-
CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys.
-
CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections.
-
CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines.
-
CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods.
-
CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default.
-
CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default.
- Record
SUSE-SU-2015:0541-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0543-1 No score
Security update for compat-openssl097g
This compat-openssl097g rollup update contains various security fixes:
* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
can result in memory corruption during buffer management operations.
Security Issue reference:
* CVE-2012-2110
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
- Record
SUSE-SU-2015:0543-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0545-1 No score
Security update for OpenSSL
OpenSSL has been updated to fix several security issues:
* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
compression by default. Setting the environment variable
'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
local attackers to gain access to transmitted plain text or private
keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.
Security Issue references:
* CVE-2013-0169
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
- Record
SUSE-SU-2015:0545-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0545-2 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:0545-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:0546-1 No score
Security update for openssl1
This OpenSSL update fixes the following issues:
* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3513
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:0546-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0547-1 No score
Security update for compat-openssl097g
OpenSSL was updated to fix several security issues:
* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
rejecting connections with DH parameters shorter than 1024 bits.
2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)
Additional changes:
* In the default SSL cipher string EXPORT ciphers are now disabled.
This will only get active if applications get rebuilt and actually
use this string. (bsc#931698)
Security Issues:
* CVE-2015-1789
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>
- Record
SUSE-SU-2015:0547-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0553-1 No score
Security update for compat-openssl098
OpenSSL was updated to fix various security issues.
Following security issues were fixed:
-
CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys.
-
CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections.
-
CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines.
-
CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods.
-
CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default.
-
CVE-2015-0292: Various issues in base64 decoding were fixed, which could lead to crashes with memory corruption, for instance by using attacker supplied PEM data.
-
CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default.
-
CVE-2009-5146: A memory leak in the TLS hostname extension was fixed, which could be used by remote attackers to run SSL services out of memory.
- Record
SUSE-SU-2015:0553-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0553-2 No score
Security update for compat-openssl098
OpenSSL was updated to fix various security issues.
Following security issues were fixed:
-
CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys.
-
CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections.
-
CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines.
-
CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods.
-
CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default.
-
CVE-2015-0292: Various issues in base64 decoding were fixed, which could lead to crashes with memory corruption, for instance by using attacker supplied PEM data.
-
CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default.
-
CVE-2009-5146: A memory leak in the TLS hostname extension was fixed, which could be used by remote attackers to run SSL services out of memory.
- Record
SUSE-SU-2015:0553-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:0578-1 No score
Security update for compat-openssl097g
This compat-openssl097g rollup update contains various security fixes:
* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
could have resulted in memory corruption during buffer management
operations.
Security Issue reference:
* CVE-2012-2110
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
- Record
SUSE-SU-2015:0578-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1182-1 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1182-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1182-2 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1182-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:1183-1 No score
Security update for compat-openssl097g
This compat-openssl097g rollup update contains various security fixes:
* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
could have resulted in memory corruption during buffer management
operations.
Security Issue reference:
* CVE-2012-2110
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
- Record
SUSE-SU-2015:1183-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1183-2 No score
Security update for compat-openssl097g
OpenSSL was updated to fix several security issues:
* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
rejecting connections with DH parameters shorter than 1024 bits.
2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)
Additional changes:
* In the default SSL cipher string EXPORT ciphers are now disabled.
This will only get active if applications get rebuilt and actually
use this string. (bsc#931698)
Security Issues:
* CVE-2015-1789
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>
- Record
SUSE-SU-2015:1183-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:1184-1 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1184-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1184-2 No score
Security update for OpenSSL
OpenSSL has been updated to fix several security issues:
* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
compression by default. Setting the environment variable
'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
local attackers to gain access to transmitted plain text or private
keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.
Security Issue references:
* CVE-2013-0169
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
- Record
SUSE-SU-2015:1184-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:1185-1 No score
Security update for openssl1
This OpenSSL update fixes the following issues:
* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3513
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1185-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2303-1 No score
Security update for mysql
The mysql package was updated to version 5.5.46 to fixs several security and non security issues.
- bnc#951391: update to version 5.5.46
- changes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html
- fixed CVEs: CVE-2015-1793, CVE-2015-0286, CVE-2015-0288, CVE-2015-1789, CVE-2015-4730, CVE-2015-4766, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913
- bnc#952196: Fixed a build error for ppc*, s390* and ia64 architectures.
- Record
SUSE-SU-2015:2303-1- Updated
- 2026-11-02
OSVSUSE-SU-403 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-403- Updated
- 2026-11-02
OSVSUSE-SU-403 Forbidden-1 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-403 Forbidden-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-0286 No score
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
- Record
UBUNTU-CVE-2015-0286- Updated
- 2026-11-02
OSVUSN-2537-1 No score
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled malformed EC private key files. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0209)
Stephen Henson discovered that OpenSSL incorrectly handled comparing ASN.1 boolean types. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0286)
Emilia Käsper discovered that OpenSSL incorrectly handled ASN.1 structure reuse. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0287)
Brian Carpenter discovered that OpenSSL incorrectly handled invalid certificate keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0288)
Michal Zalewski discovered that OpenSSL incorrectly handled missing outer ContentInfo when parsing PKCS#7 structures. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0289)
Robert Dugal and David Ramos discovered that OpenSSL incorrectly handled decoding Base64 encoded data. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2015-0292)
Sean Burford and Emilia Käsper discovered that OpenSSL incorrectly handled specially crafted SSLv2 CLIENT-MASTER-KEY messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0293)
- Record
USN-2537-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 |
before 1.0.1k-2 | 1.0.1k-2 |
opensslDebian:13 |
before 1.0.1k-2 | 1.0.1k-2 |
opensslDebian:14 |
before 1.0.1k-2 | 1.0.1k-2 |
opensslDebian:6.0 From an advisory covering 7 CVEs |
before 0.9.8o-4squeeze20, plus listed versions 0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13 Show 14 moreShow less0.9.8o-4squeeze140.9.8o-4squeeze150.9.8o-4squeeze160.9.8o-4squeeze170.9.8o-4squeeze180.9.8o-4squeeze190.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9 |
0.9.8o-4squeeze20 |
opensslDebian:7 From an advisory covering 6 CVEs |
before 1.0.1e-2+deb7u15, plus listed versions 1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u101.0.1e-2+deb7u111.0.1e-2+deb7u12 Show 10 moreShow less1.0.1e-2+deb7u131.0.1e-2+deb7u141.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9 |
1.0.1e-2+deb7u15 |
opensslMageia:4 From an advisory covering 6 CVEs |
before 1.0.1m-1.mga4 | 1.0.1m-1.mga4 |
opensslRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
Show 90 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openssl-staticRed Hat:enterprise_linux:6::client From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
opensslRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-staticRed Hat:enterprise_linux:6::computenode From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
opensslRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-staticRed Hat:enterprise_linux:6::server From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
opensslRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-staticRed Hat:enterprise_linux:6::workstation From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
opensslRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-libsRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-develRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-perlRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-staticRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
opensslRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-libsRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-develRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-perlRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-staticRed Hat:enterprise_linux:7::computenode From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
opensslRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-develRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-libsRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-perlRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
openssl-staticRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs |
before 1:1.0.1e-42.ael7b_1.4 | 1:1.0.1e-42.ael7b_1.4 |
opensslRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-develRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-libsRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-perlRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
openssl-staticRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs |
before 1:1.0.1e-42.el7_1.4 | 1:1.0.1e-42.el7_1.4 |
opensslRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-debuginfoRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-develRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-perlRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
openssl-staticRed Hat:storage:2.1:server:el6 From an advisory covering 9 CVEs |
before 0:1.0.1e-30.el6_6.7 | 0:1.0.1e-30.el6_6.7 |
opensslSUSE:Linux Enterprise Desktop 12 From an advisory covering 6 CVEs |
before 1.0.1i-20.1 | 1.0.1i-20.1 |
opensslSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 6 CVEs |
before 1.0.1i-20.1 | 1.0.1i-20.1 |
opensslSUSE:Linux Enterprise Server 12 From an advisory covering 6 CVEs |
before 1.0.1i-20.1 | 1.0.1i-20.1 |
opensslSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 6 CVEs |
before 1.0.1i-20.1 | 1.0.1i-20.1 |
compat-openssl098SUSE:Linux Enterprise Module for Legacy 12 From an advisory covering 8 CVEs |
before 0.9.8j-73.2 | 0.9.8j-73.2 |
compat-openssl098SUSE:Linux Enterprise Desktop 12 From an advisory covering 8 CVEs |
before 0.9.8j-73.2 | 0.9.8j-73.2 |
mysqlSUSE:Linux Enterprise Software Development Kit 11 SP3 From an advisory covering 29 CVEs |
before 5.5.46-0.14.1 | 5.5.46-0.14.1 |
mysqlSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 29 CVEs |
before 5.5.46-0.14.1 | 5.5.46-0.14.1 |
mysqlSUSE:Linux Enterprise Desktop 11 SP3 From an advisory covering 29 CVEs |
before 5.5.46-0.14.1 | 5.5.46-0.14.1 |
mysqlSUSE:Linux Enterprise Desktop 11 SP4 From an advisory covering 29 CVEs |
before 5.5.46-0.14.1 | 5.5.46-0.14.1 |
mysqlSUSE:Linux Enterprise Server 11 SP3 From an advisory covering 29 CVEs |
before 5.5.46-0.14.1 | 5.5.46-0.14.1 |
mysqlSUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 29 CVEs |
before 5.5.46-0.14.1 | 5.5.46-0.14.1 |
mysqlSUSE:Linux Enterprise Server for SAP Applications 11 SP3 From an advisory covering 29 CVEs |
before 5.5.46-0.14.1 | 5.5.46-0.14.1 |
mysqlSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 29 CVEs |
before 5.5.46-0.14.1 | 5.5.46-0.14.1 |
mysqlSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 29 CVEs |
before 5.5.46-0.14.1 | 5.5.46-0.14.1 |
libqt4SUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs |
before 4.8.6-7.1 | 4.8.6-7.1 |
opensslUbuntu:14.04:LTS |
before 1.0.1f-1ubuntu2.11, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 9 moreShow less1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.8 |
1.0.1f-1ubuntu2.11 |
opensslUbuntu:14.04:LTS From an advisory covering 7 CVEs |
before 1.0.1f-1ubuntu2.11, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 9 moreShow less1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.8 |
1.0.1f-1ubuntu2.11 |
libresslopenSUSE:Tumbleweed From an advisory covering 30 CVEs |
before 2.5.0-1.1 | 2.5.0-1.1 |
openssl-1_1openSUSE:Tumbleweed From an advisory covering 136 CVEs |
before 1.1.1l-1.2 | 1.1.1l-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0286 is a medium vulnerability (CVSS 5.0) in Openssl, published August 30, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 19.9%, the 97th percentile. Fixed in openssl 1.0.1k-2.
References
kc.mcafee.com/corporate/index?page=content&id=SB10110
oracle.com/technetwork/topics/security/cpujul2015-2367936.html
rhn.redhat.com/errata/RHSA-2015-0715.html
lists.opensuse.org/opensuse-updates/2015-03/msg00062.html
kb.juniper.net/InfoCenter/index?page=content&id=JSA10680
debian.org/security/2015/dsa-3197
Show 194 moreShow less
ubuntu.com/usn/USN-2537-1
marc.info?l=bugtraq&m=144050155601375&w=2
lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
bto.bluecoat.com/security-advisory/sa92
openssl.org/news/secadv_20150319.txt
support.apple.com/HT205212
lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
access.redhat.com/articles/1384453
securitytracker.com/id/1032917
bugzilla.redhat.com/show_bug.cgi?id=1202366
mandriva.com/security/advisories?name=MDVSA-2015:063
fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015
freebsd.org/security/advisories/FreeBSD-SA-15%3A06.openssl.asc
git.openssl.org?p=openssl.git%3Ba=commit%3Bh=c3c7fb07dc975dc3c9de0eddb7d8fd79fc9c67c1
support.citrix.com/article/CTX216642
securityfocus.com/bid/73225
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
nvd.nist.gov/vuln/detail/CVE-2015-0286
github.com/advisories/GHSA-77f5-q9w4-mgwj
docs.bell-sw.com/security/cves/CVE-2015-0286
security-tracker.debian.org/tracker/CVE-2015-0286
advisories.mageia.org/MGASA-2015-0111.html
bugs.mageia.org/show_bug.cgi?id=15530
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0715.json
cve.org/CVERecord?id=CVE-2015-0209
suse.com/support/update/announcement/-2022-445/suse-fu-20220445-1
bugzilla.suse.com/1000080
ubuntu.com/security/CVE-2015-0286
Left out here: 769 references. The JSON record has them.