Every CVE Search/ Get API key

CVE-2014-8275

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain...

5.0 MediumPublic exploitFix available

CVE-2014-8275 is a medium vulnerability (CVSS 5.0) in Openssl, published August 30, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 15.0%, the 96th percentile. Fixed in openssl 1.0.1k-1.

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Exploit likelihood

15.0%Up 7.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Record
CVE-2014-8275
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Record
CVE-2014-8275
Updated
2026-11-02
EUVDEUVD-2014-8116 No score

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Record
EUVD-2014-8116
Updated
2026-11-03
GitHub AdvisoriesGHSA-85qv-mgh4-gm8w No score

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain...

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Record
GHSA-85qv-mgh4-gm8w
Updated
2026-11-02
OSVRHSA-2015:0066 5.3

Red Hat Security Advisory: openssl security update

Record
RHSA-2015:0066
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2015:0800 5.3

Red Hat Security Advisory: openssl security update

Record
RHSA-2015:0800
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 31 moreShow less
OSV No score

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Record
CVE-2014-8275
Updated
2026-11-02
OSVDEBIAN-CVE-2014-8275 No score

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Record
DEBIAN-CVE-2014-8275
Updated
2026-11-02
OSVMGASA-2015-0022 No score

Updated openssl packages fix security vulnerabilities

A carefully crafted DTLS message can cause a segmentation fault in OpenSSL due to a NULL pointer dereference. This could lead to a Denial Of Service attack (CVE-2014-3571).

A memory leak can occur in the dtls1_buffer_record function under certain conditions. In particular this could occur if an attacker sent repeated DTLS records with the same sequence number but for the next epoch. The memory leak could be exploited by an attacker in a Denial of Service attack through memory exhaustion (CVE-2015-0206).

When openssl is built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl method would be set to NULL which could later result in a NULL pointer dereference (CVE-2014-3569).

An OpenSSL client will accept a handshake using an ephemeral ECDH ciphersuite using an ECDSA certificate if the server key exchange message is omitted. This effectively removes forward secrecy from the ciphersuite (CVE-2014-3572).

An OpenSSL client will accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. A server could present a weak temporary key and downgrade the security of the session (CVE-2015-0204).

An OpenSSL server will accept a DH certificate for client authentication without the certificate verify message. This effectively allows a client to authenticate without the use of a private key. This only affects servers which trust a client certificate authority which issues certificates containing DH keys: these are extremely rare and hardly ever encountered (CVE-2015-0205).

OpenSSL accepts several non-DER-variations of certificate signature algorithm and signature encodings. OpenSSL also does not enforce a match between the signature algorithm between the signed and unsigned portions of the certificate. By modifying the contents of the signature algorithm or the encoding of the signature, it is possible to change the certificate's fingerprint. This does not allow an attacker to forge certificates, and does not affect certificate verification or OpenSSL servers/clients in any other way. It also does not affect common revocation mechanisms. Only custom applications that rely on the uniqueness of the fingerprint (e.g. certificate blacklists) may be affected (CVE-2014-8275).

Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64. This bug occurs at random with a very low probability, and is not known to be exploitable in any way, though its exact impact is difficult to determine (CVE-2014-3570).

The updated packages have been upgraded to the 1.0.1k version where these security flaws have been fixed.

Record
MGASA-2015-0022
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10309-1 No score

libcrypto38-2.5.0-1.1 on GA media

These are all security issues fixed in the libcrypto38-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10309-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-RU-2015:0769-1
Updated
2026-11-02
OSVSUSE-SU-2015:0182-2 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:0182-2
Updated
2026-11-02
OSVSUSE-SU-2015:0305-1 No score

Security update for compat-openssl098

The openssl 0.9.8j compatibility package was updated to fix several security vulnerabilities:

CVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64.

CVE-2014-3571: Fix crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record.

CVE-2014-3572: Do not accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted.

CVE-2014-8275: Fixed various certificate fingerprint issues

CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites

CVE-2015-0205: OpenSSL 0.9.8j is NOT vulnerable to CVE-2015-0205 as it doesn't support DH certificates and this typo prohibits skipping of certificate verify message for sign only certificates anyway. (This patch only fixes the wrong condition)

This update also fixes regression caused by CVE-2014-0224.patch (bnc#892403)

Record
SUSE-SU-2015:0305-1
Updated
2026-11-02
OSVSUSE-SU-2015:0543-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  can result in memory corruption during buffer management operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:0543-1
Updated
2026-11-02
OSVSUSE-SU-2015:0545-1 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
Record
SUSE-SU-2015:0545-1
Updated
2026-11-02
OSVSUSE-SU-2015:0545-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0545-2
Updated
2026-11-02
OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0546-1
Updated
2026-11-02
OSVSUSE-SU-2015:0547-1 No score

Security update for compat-openssl097g

OpenSSL was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
  rejecting connections with DH parameters shorter than 1024 bits.
  2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
  was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
  This will only get active if applications get rebuilt and actually
  use this string. (bsc#931698)

Security Issues:

* CVE-2015-1789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>
Record
SUSE-SU-2015:0547-1
Updated
2026-11-02
OSVSUSE-SU-2015:0578-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:0578-1
Updated
2026-11-02
OSVSUSE-SU-2015:0620-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
Record
SUSE-SU-2015:0620-1
Updated
2026-11-02
OSVSUSE-SU-2015:0946-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
Record
SUSE-SU-2015:0946-1
Updated
2026-11-02
OSVSUSE-SU-2015:1177-1 No score

Security update for MySQL

This MySQL update provides the following:

* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
  CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
  CVE-2014-4240, CVE-2014-4214, CVE-2014-4243

See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Security Issues:

* CVE-2014-2484
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
Record
SUSE-SU-2015:1177-1
Updated
2026-11-02
OSVSUSE-SU-2015:1182-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1182-1
Updated
2026-11-02
OSVSUSE-SU-2015:1182-2 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1182-2
Updated
2026-11-02
OSVSUSE-SU-2015:1183-1 No score

Security update for compat-openssl097g

This compat-openssl097g rollup update contains various security fixes:

* CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL
  could have resulted in memory corruption during buffer management
  operations.

Security Issue reference:

* CVE-2012-2110
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110>
Record
SUSE-SU-2015:1183-1
Updated
2026-11-02
OSVSUSE-SU-2015:1183-2 No score

Security update for compat-openssl097g

OpenSSL was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by
  rejecting connections with DH parameters shorter than 1024 bits.
  2048-bit DH parameters are now generated by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
  was fixed.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
  This will only get active if applications get rebuilt and actually
  use this string. (bsc#931698)

Security Issues:

* CVE-2015-1789
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>
Record
SUSE-SU-2015:1183-2
Updated
2026-11-02
OSVSUSE-SU-2015:1184-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1184-1
Updated
2026-11-02
OSVSUSE-SU-2015:1184-2 No score

Security update for OpenSSL

OpenSSL has been updated to fix several security issues:

* CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL
  compression by default. Setting the environment variable
  'OPENSSL_NO_DEFAULT_ZLIB' to 'no' enables compression again.
* CVE-2013-0169: Timing attacks against TLS could be used by physically
  local attackers to gain access to transmitted plain text or private
  keymaterial. This issue is also known as the 'Lucky-13' issue.
* CVE-2013-0166: A OCSP invalid key denial of service issue was fixed.

Security Issue references:

* CVE-2013-0169
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169>
* CVE-2013-0166
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166>
Record
SUSE-SU-2015:1184-2
Updated
2026-11-02
OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1185-1
Updated
2026-11-02
OSVSUSE-SU-403 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-403
Updated
2026-11-02
OSVSUSE-SU-403 Forbidden-1 No score

Security update for OpenSSL

This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-403 Forbidden-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-8275 No score

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Record
UBUNTU-CVE-2014-8275
Updated
2026-11-02
OSVUSN-2459-1 No score

openssl vulnerabilities

Pieter Wuille discovered that OpenSSL incorrectly handled Bignum squaring. (CVE-2014-3570)

Markus Stenberg discovered that OpenSSL incorrectly handled certain crafted DTLS messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2014-3571)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled certain handshakes. A remote attacker could possibly use this issue to downgrade to ECDH, removing forward secrecy from the ciphersuite. (CVE-2014-3572)

Antti Karjalainen, Tuomo Untinen and Konrad Kraszewski discovered that OpenSSL incorrectly handled certain certificate fingerprints. A remote attacker could possibly use this issue to trick certain applications that rely on the uniqueness of fingerprints. (CVE-2014-8275)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled certain key exchanges. A remote attacker could possibly use this issue to downgrade the security of the session to EXPORT_RSA. (CVE-2015-0204)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled client authentication. A remote attacker could possibly use this issue to authenticate without the use of a private key in certain limited scenarios. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0205)

Chris Mueller discovered that OpenSSL incorrect handled memory when processing DTLS records. A remote attacker could use this issue to cause OpenSSL to consume resources, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0206)

Record
USN-2459-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 1.0.1k-1
1.0.1k-1
openssl
Debian:13
 before 1.0.1k-1
1.0.1k-1
openssl
Debian:14
 before 1.0.1k-1
1.0.1k-1
openssl
Debian:6.0
 before 0.9.8o-4squeeze19, plus listed versions
0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13
Show 13 moreShow less
0.9.8o-4squeeze140.9.8o-4squeeze150.9.8o-4squeeze160.9.8o-4squeeze170.9.8o-4squeeze180.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9
0.9.8o-4squeeze19
openssl
Debian:7
 before 1.0.1e-2+deb7u14, plus listed versions
1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u101.0.1e-2+deb7u111.0.1e-2+deb7u12
Show 9 moreShow less
1.0.1e-2+deb7u131.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9
1.0.1e-2+deb7u14
openssl
Mageia:4
 before 1.0.1k-1.mga4
1.0.1k-1.mga4
openssl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-devel
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-perl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
Show 81 moreShow less
Affected packages
PackageAffectedFixed
openssl-static
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-perl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-static
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-devel
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-perl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-static
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-perl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl-static
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-30.el6_6.5
0:1.0.1e-30.el6_6.5
openssl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-debuginfo
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-libs
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-devel
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-perl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-static
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-libs
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-devel
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-perl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-static
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-devel
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-libs
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-perl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-static
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-devel
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-libs
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-perl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl-static
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.7
1:1.0.1e-34.el7_0.7
openssl
Red Hat:enterprise_linux:5::client
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
openssl-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
openssl-perl
Red Hat:enterprise_linux:5::client
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
openssl
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
openssl-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
openssl-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
openssl
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
openssl-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
openssl-devel
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
openssl-perl
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-33.el5_11
0:0.9.8e-33.el5_11
compat-openssl098
SUSE:Linux Enterprise Desktop 12
 before 0.9.8j-70.2
0.9.8j-70.2
compat-openssl098
SUSE:Linux Enterprise Module for Legacy 12
 before 0.9.8j-70.2
0.9.8j-70.2
libqt4
SUSE:Linux Enterprise Desktop 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Desktop 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Desktop 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Desktop 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Software Development Kit 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Software Development Kit 12
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Software Development Kit 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server 12
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server for SAP Applications 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 12
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server for SAP Applications 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server 12 SP1
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 4.8.6-7.3
4.8.6-7.3
libqt4-sql-plugins
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Workstation Extension 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Workstation Extension 12
 before 4.8.6-7.1
4.8.6-7.1
libqt4
SUSE:Linux Enterprise Workstation Extension 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
libqt4-sql-plugins
SUSE:Linux Enterprise Workstation Extension 12 SP1
 before 4.8.6-7.1
4.8.6-7.1
openssl
Ubuntu:14.04:LTS
 before 1.0.1f-1ubuntu2.8, plus listed versions
1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4
Show 8 moreShow less
1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.7
1.0.1f-1ubuntu2.8
libressl
openSUSE:Tumbleweed
 before 2.5.0-1.1
2.5.0-1.1
openssl-1_1
openSUSE:Tumbleweed
 before 1.1.1l-1.2
1.1.1l-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubuthrasri/CVE-2014-8275_openssl_g2.52023-11-07
PoC in GitHubuthrasri/Openssl_G2.5_CVE-2014-82752023-11-07

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 803 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open