Every CVE Search/ Get API key

CVE-2015-1789

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0...

7.5 HighFix available

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

75.7%Up 68.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Record
CVE-2015-1789
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Record
CVE-2015-1789
Updated
2026-11-02
EUVDEUVD-2015-1915 No score

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Record
EUVD-2015-1915
Updated
2026-11-03
GitHub AdvisoriesGHSA-q289-c6qx-8gxc 7.5

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0...

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Record
GHSA-q289-c6qx-8gxc
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 7.5

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Record
CVE-2015-1789
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2015-1789 7.5

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Record
DEBIAN-CVE-2015-1789
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 31 moreShow less
OSVRHSA-2015:1115 7.5

Red Hat Security Advisory: openssl security update

Record
RHSA-2015:1115
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2015:1197 3.7

Red Hat Security Advisory: openssl security update

Record
RHSA-2015:1197
CVSS 3.0
3.7 LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2015-1789 7.5

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Record
UBUNTU-CVE-2015-1789
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2015-0246 No score

Updated openssl package fixes security vulnerabilities

A vulnerability in the TLS protocol allows a man-in-the-middle attacker to downgrade vulnerable TLS connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. This vulnerability is known as Logjam (CVE-2015-4000).

When processing an ECParameters structure OpenSSL enters an infinite loop if the curve specified is over a specially malformed binary polynomial field. This can be used to perform denial of service against any system which processes public keys, certificate requests or certificates. This includes TLS clients and TLS servers with client authentication enabled (CVE-2015-1788).

X509_cmp_time does not properly check the length of the ASN1_TIME string and can read a few bytes out of bounds. In addition, X509_cmp_time accepts an arbitrary number of fractional seconds in the time string. An attacker can use this to craft malformed certificates and CRLs of various sizes and potentially cause a segmentation fault, resulting in a DoS on applications that verify certificates or CRLs. TLS clients that verify CRLs are affected. TLS clients and servers with client authentication enabled may be affected if they use custom verification callbacks (CVE-2015-1789).

The PKCS#7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing (CVE-2015-1790).

If a NewSessionTicket is received by a multi-threaded client when attempting to reuse a previous ticket then a race condition can occur potentially leading to a double free of the ticket data (CVE-2015-1791).

When verifying a signedData message the CMS code can enter an infinite loop if presented with an unknown hash function OID. This can be used to perform denial of service against any system which verifies signedData messages using the CMS code (CVE-2015-1792).

Record
MGASA-2015-0246
Updated
2026-11-02
OSVopenSUSE-SU-2024:10200-1 No score

libmysql56client18-32bit-5.6.34-1.1 on GA media

These are all security issues fixed in the libmysql56client18-32bit-5.6.34-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10200-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10309-1 No score

libcrypto38-2.5.0-1.1 on GA media

These are all security issues fixed in the libcrypto38-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10309-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-RU-2015:0769-1
Updated
2026-11-02
OSVSUSE-SU-2015:0182-2 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:0182-2
Updated
2026-11-02
OSVSUSE-SU-2015:0543-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:0543-1
Updated
2026-11-02
OSVSUSE-SU-2015:0545-1 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
Record
SUSE-SU-2015:0545-1
Updated
2026-11-02
OSVSUSE-SU-2015:0545-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0545-2
Updated
2026-11-02
OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0546-1
Updated
2026-11-02
OSVSUSE-SU-2015:0547-1 No score

Security update for compat-openssl097g

OpenSSL was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
  rejecting connections with DH parameters shorter than 1024 bits.
  2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
  was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
  This will only get active if applications get rebuilt and actually
  use this string. (bsc#931698)

Security Issues:

* CVE-2015-1789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>
Record
SUSE-SU-2015:0547-1
Updated
2026-11-02
OSVSUSE-SU-2015:0578-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:0578-1
Updated
2026-11-02
OSVSUSE-SU-2015:1143-1 No score

Security update for openssl

This update of openssl fixes the following security issues:

  • CVE-2015-4000 (bsc#931698)
    • The Logjam Attack / weakdh.org
    • reject connections with DH parameters shorter than 1024 bits
    • generates 2048-bit DH parameters by default
  • CVE-2015-1788 (bsc#934487)
    • Malformed ECParameters causes infinite loop
  • CVE-2015-1789 (bsc#934489)
    • Exploitable out-of-bounds read in X509_cmp_time
  • CVE-2015-1790 (bsc#934491)
    • PKCS7 crash with missing EnvelopedContent
  • CVE-2015-1792 (bsc#934493)
    • CMS verify infinite loop with unknown hash function
  • CVE-2015-1791 (bsc#933911)
    • race condition in NewSessionTicket
  • CVE-2015-3216 (bsc#933898)
    • Crash in ssleay_rand_bytes due to locking regression
  • fix a timing side channel in RSA decryption (bnc#929678)
Record
SUSE-SU-2015:1143-1
Updated
2026-11-02
OSVSUSE-SU-2015:1150-1 No score

Security update for compat-openssl098

This update fixes the following security issues:

  • CVE-2015-4000 (boo#931698)
    • The Logjam Attack / weakdh.org
    • reject connections with DH parameters shorter than 1024 bits
    • generates 2048-bit DH parameters by default
  • CVE-2015-1788 (boo#934487)
    • Malformed ECParameters causes infinite loop
  • CVE-2015-1789 (boo#934489)
    • Exploitable out-of-bounds read in X509_cmp_time
  • CVE-2015-1790 (boo#934491)
    • PKCS7 crash with missing EnvelopedContent
  • CVE-2015-1792 (boo#934493)
    • CMS verify infinite loop with unknown hash function
  • CVE-2015-1791 (boo#933911)
    • race condition in NewSessionTicket
  • CVE-2015-3216 (boo#933898)
    • Crash in ssleay_rand_bytes due to locking regression
    • modified openssl-1.0.1i-fipslocking.patch
  • fix timing side channel in RSA decryption (bnc#929678)
  • add ECC ciphersuites to DEFAULT (bnc#879179)
  • Disable EXPORT ciphers by default (bnc#931698, comment #3)
Record
SUSE-SU-2015:1150-1
Updated
2026-11-02
OSVSUSE-SU-2015:1182-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1182-1
Updated
2026-11-02
OSVSUSE-SU-2015:1182-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1182-2
Updated
2026-11-02
OSVSUSE-SU-2015:1183-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:1183-1
Updated
2026-11-02
OSVSUSE-SU-2015:1183-2 No score

Security update for compat-openssl097g

OpenSSL was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
  rejecting connections with DH parameters shorter than 1024 bits.
  2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
  was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
  This will only get active if applications get rebuilt and actually
  use this string. (bsc#931698)

Security Issues:

* CVE-2015-1789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>
Record
SUSE-SU-2015:1183-2
Updated
2026-11-02
OSVSUSE-SU-2015:1184-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1184-1
Updated
2026-11-02
OSVSUSE-SU-2015:1184-2 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
Record
SUSE-SU-2015:1184-2
Updated
2026-11-02
OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1185-1
Updated
2026-11-02
OSVSUSE-SU-2015:2303-1 No score

Security update for mysql

The mysql package was updated to version 5.5.46 to fixs several security and non security issues.

  • bnc#951391: update to version 5.5.46
    • changes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html
    • fixed CVEs: CVE-2015-1793, CVE-2015-0286, CVE-2015-0288, CVE-2015-1789, CVE-2015-4730, CVE-2015-4766, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913
  • bnc#952196: Fixed a build error for ppc*, s390* and ia64 architectures.
Record
SUSE-SU-2015:2303-1
Updated
2026-11-02
OSVSUSE-SU-403 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-403
Updated
2026-11-02
OSVSUSE-SU-403 Forbidden-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-403 Forbidden-1
Updated
2026-11-02
OSVUSN-2639-1 No score

openssl vulnerabilities

Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that OpenSSL incorrectly handled memory when buffering DTLS data. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-8176)

Joseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed ECParameters structures. A remote attacker could use this issue to cause OpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)

Robert Swiecki and Hanno Böck discovered that OpenSSL incorrectly handled certain ASN1_TIME strings. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-1789)

Michal Zalewski discovered that OpenSSL incorrectly handled missing content when parsing ASN.1-encoded PKCS#7 blobs. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-1790)

Emilia Käsper discovered that OpenSSL incorrectly handled NewSessionTicket when being used by a multi-threaded client. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-1791)

Johannes Bauer discovered that OpenSSL incorrectly handled verifying signedData messages using the CMS code. A remote attacker could use this issue to cause OpenSSL to hang, resulting in a denial of service. (CVE-2015-1792)

As a security improvement, this update also modifies OpenSSL behaviour to reject DH key sizes below 768 bits, preventing a possible downgrade attack.

Record
USN-2639-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 1.0.2b-1
1.0.2b-1
openssl
Debian:13
 before 1.0.2b-1
1.0.2b-1
openssl
Debian:14
 before 1.0.2b-1
1.0.2b-1
openssl
Debian:6.0
From an advisory covering 6 CVEs
 before 0.9.8o-4squeeze21, plus listed versions
0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13
Show 15 moreShow less
0.9.8o-4squeeze140.9.8o-4squeeze150.9.8o-4squeeze160.9.8o-4squeeze170.9.8o-4squeeze180.9.8o-4squeeze190.9.8o-4squeeze20.9.8o-4squeeze200.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9
0.9.8o-4squeeze21
openssl
Debian:7
From an advisory covering 7 CVEs
 before 1.0.1e-2+deb7u17, plus listed versions
1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u101.0.1e-2+deb7u111.0.1e-2+deb7u12
Show 12 moreShow less
1.0.1e-2+deb7u131.0.1e-2+deb7u141.0.1e-2+deb7u151.0.1e-2+deb7u161.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9
1.0.1e-2+deb7u17
openssl
Debian:8
From an advisory covering 7 CVEs
 before 1.0.1k-3+deb8u1, plus listed versions
1.0.1k-31.0.1k-3+alpha
1.0.1k-3+deb8u1
openssl
Mageia:4
From an advisory covering 6 CVEs
 before 1.0.1o-1.mga4
1.0.1o-1.mga4
openssl
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
Show 96 moreShow less
Affected packages
PackageAffectedFixed
openssl-perl
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-static
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-perl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-static
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-perl
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-static
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-perl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl-static
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:1.0.1e-30.el6_6.11
0:1.0.1e-30.el6_6.11
openssl
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-libs
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-perl
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-static
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-libs
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-perl
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-static
Red Hat:enterprise_linux:7::computenode
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.ael7b_1.8
1:1.0.1e-42.ael7b_1.8
openssl-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.ael7b_1.8
1:1.0.1e-42.ael7b_1.8
openssl-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.ael7b_1.8
1:1.0.1e-42.ael7b_1.8
openssl-libs
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.ael7b_1.8
1:1.0.1e-42.ael7b_1.8
openssl-perl
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.ael7b_1.8
1:1.0.1e-42.ael7b_1.8
openssl-static
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.ael7b_1.8
1:1.0.1e-42.ael7b_1.8
openssl
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-libs
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-perl
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl-static
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 1:1.0.1e-42.el7_1.8
1:1.0.1e-42.el7_1.8
openssl
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl-perl
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl-perl
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:0.9.8e-36.el5_11
0:0.9.8e-36.el5_11
openssl
SUSE:Linux Enterprise Desktop 12
From an advisory covering 7 CVEs
 before 1.0.1i-25.1
1.0.1i-25.1
openssl
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 7 CVEs
 before 1.0.1i-25.1
1.0.1i-25.1
openssl
SUSE:Linux Enterprise Server 12
From an advisory covering 7 CVEs
 before 1.0.1i-25.1
1.0.1i-25.1
openssl
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 7 CVEs
 before 1.0.1i-25.1
1.0.1i-25.1
compat-openssl098
SUSE:Linux Enterprise Desktop 12
From an advisory covering 7 CVEs
 before 0.9.8j-78.1
0.9.8j-78.1
compat-openssl098
SUSE:Linux Enterprise Module for Legacy 12
From an advisory covering 7 CVEs
 before 0.9.8j-78.1
0.9.8j-78.1
mysql
SUSE:Linux Enterprise Software Development Kit 11 SP3
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Desktop 11 SP3
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Desktop 11 SP4
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Server 11 SP3
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Server for SAP Applications 11 SP3
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
libqt4
SUSE:Linux Enterprise Desktop 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Desktop 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Desktop 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Desktop 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server 12
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Workstation Extension 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Workstation Extension 12
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Workstation Extension 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Workstation Extension 12 SP1
From an advisory covering 54 CVEs
 before 4.8.6-7.1
4.8.6-7.1
openssl
Ubuntu:14.04:LTS
 before 1.0.1f-1ubuntu2.15, plus listed versions
1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4
Show 11 moreShow less
1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.81.0.1f-1ubuntu2.111.0.1f-1ubuntu2.12
1.0.1f-1ubuntu2.15
openssl
Ubuntu:14.04:LTS
From an advisory covering 6 CVEs
 before 1.0.1f-1ubuntu2.15, plus listed versions
1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4
Show 11 moreShow less
1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.81.0.1f-1ubuntu2.111.0.1f-1ubuntu2.12
1.0.1f-1ubuntu2.15
libressl
openSUSE:Tumbleweed
From an advisory covering 30 CVEs
 before 2.5.0-1.1
2.5.0-1.1
openssl-1_1
openSUSE:Tumbleweed
From an advisory covering 136 CVEs
 before 1.1.1l-1.2
1.1.1l-1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1789 is a high vulnerability (CVSS 7.5) in Openssl, published August 30, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 75.7%, the 99th percentile. Fixed in openssl 1.0.2b-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 760 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open