{"id":"CVE-2015-3281","aliases":["DEBIAN-CVE-2015-3281","DSA-3301-1","EUVD-2015-3328","GHSA-ffg4-hmhr-qr79","RHSA-2015:1741","RHSA-2015:2666","SUSE-SU-2015:1663-1","SUSE-SU-2015:1776-1","UBUNTU-CVE-2015-3281","openSUSE-SU-2024:10114-1"],"status":"published","title":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly...","description":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04326,"percentile":0.91243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-07-05T00:00:00Z","modified":"2026-09-09T06:47:29Z","fixes":[{"ecosystem":"Debian:12","package":"haproxy","fixed_in":["1.5.14-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"haproxy","fixed_in":["1.5.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"haproxy","fixed_in":["1.5.14-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"haproxy","fixed_in":["1.5.8-3+deb8u1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"haproxy","fixed_in":["0:1.5.4-2.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"haproxy-debuginfo","fixed_in":["0:1.5.4-2.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"haproxy","fixed_in":["0:1.5.4-4.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"haproxy-debuginfo","fixed_in":["0:1.5.4-4.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"haproxy","fixed_in":["0:1.5.4-4.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"haproxy-debuginfo","fixed_in":["0:1.5.4-4.el7_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"rhc","fixed_in":["0:1.38.4.5-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-release","fixed_in":["0:2.2.8-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-upgrade","fixed_in":["0:2.2.8-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-upgrade-broker","fixed_in":["0:2.2.8-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-yum-validator","fixed_in":["0:2.2.8-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-broker-util","fixed_in":["0:1.37.4.2-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"rubygem-openshift-origin-common","fixed_in":["0:1.29.4.1-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"rubygem-openshift-origin-controller","fixed_in":["0:1.38.4.2-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"rubygem-openshift-origin-routing-daemon","fixed_in":["0:0.26.4.4-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-cartridge-jbosseap","fixed_in":["0:2.27.3.1-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"haproxy15side","fixed_in":["0:1.5.4-2.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"haproxy15side-debuginfo","fixed_in":["0:1.5.4-2.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-upgrade-node","fixed_in":["0:2.2.8-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-cartridge-haproxy","fixed_in":["0:1.31.4.1-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-cartridge-jbossews","fixed_in":["0:1.35.3.2-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-cartridge-python","fixed_in":["0:1.34.1.1-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-node-util","fixed_in":["0:1.38.5.1-1.el6op"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:2.0::el6","package":"rubygem-openshift-origin-node","fixed_in":["0:1.38.4.1-1.el6op"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"haproxy","fixed_in":["1.5.4-12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.14-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.14-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-3+deb8u1"}]}],"versions":["1.5.8-3","1.5.8-3+deb8u1~bpo60+1","1.5.8-3+deb8u1~bpo70+1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-2.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-2.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-4.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-4.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-4.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-4.el7_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"rhc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.38.4.5-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-release","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-upgrade-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-yum-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-broker-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.37.4.2-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"rubygem-openshift-origin-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.4.1-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"rubygem-openshift-origin-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.38.4.2-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"rubygem-openshift-origin-routing-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26.4.4-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-cartridge-jbosseap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.27.3.1-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"haproxy15side","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-2.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"haproxy15side-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-2.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-enterprise-upgrade-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-cartridge-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.4.1-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-cartridge-jbossews","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35.3.2-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-cartridge-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.1.1-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"openshift-origin-node-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.38.5.1-1.el6op"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:2.0::el6","package":"rubygem-openshift-origin-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.38.4.1-1.el6op"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-2.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-2.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"haproxy","product":"haproxy"},{"vendor":"opensuse","product":"openstack_cloud"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"suse","product":"linux_enterprise_high_availability_extension"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2015-1741.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.haproxy.org/news.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-2666.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2668-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://git.haproxy.org/?p=haproxy-1.5.git%3Ba=commit%3Bh=7ec765568883b2d4e5a2796adbeb492a22ec9bd4","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3301","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/75554","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3281","tags":["advisory"]},{"url":"http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4"},{"url":"https://access.redhat.com/errata/RHSA-2015:1741","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2666","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1239072","tags":["report"]},{"url":"https://github.com/advisories/GHSA-ffg4-hmhr-qr79"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3281","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1741.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3281","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1045226","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1054441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1101973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1111501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1111598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1139608","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1140766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1155003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1177753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1238305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1241675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1248439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1255426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1264722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1265609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1268080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1270660","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1272195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1277695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1280438","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1282520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1282940","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2666.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151663-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/937042","tags":["report"]},{"url":"https://bugzilla.suse.com/937202","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4000","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151776-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/947204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3281","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2668-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6269","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3281","description":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.","status":"published","published":"2015-07-06T14:55:00Z","modified":"2024-08-06T05:39:32.116Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2015-3328","description":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.","status":"published","published":"2015-07-06T14:55:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-ffg4-hmhr-qr79","title":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly...","description":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.","status":"published","published":"2022-05-14T00:57:40Z","modified":"2023-02-10T05:06:45Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:54:02.847747Z"}],"nvd":[{"id":"CVE-2015-3281","description":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.","status":"published","published":"2015-07-06T15:59:06.167Z","modified":"2026-06-17T00:25:39.923Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:05.884985Z"}],"osv":[{"id":"CVE-2015-3281","description":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.","status":"published","published":"2015-07-06T15:59:06Z","modified":"2026-04-10T03:45:15.321071Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3281","description":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.","status":"published","published":"2015-07-06T15:59:06.167Z","modified":"2026-09-09T06:47:29.474812756Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DSA-3301-1","title":"haproxy - security update","status":"published","published":"2015-07-05T00:00:00Z","modified":"2026-03-09T01:20:43.064476Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"openSUSE-SU-2024:10114-1","title":"haproxy-1.7.0-1.1 on GA media","description":"These are all security issues fixed in the haproxy-1.7.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:39:16.730424Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:1741","title":"Red Hat Security Advisory: haproxy security update","status":"published","published":"2024-09-15T22:45:03Z","modified":"2026-06-27T10:03:04Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:2666","title":"Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.8 security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:44:57Z","modified":"2026-06-27T10:03:41Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:1663-1","title":"Security update for haproxy","description":"haproxy was updated to fix two security issues.\n\nThese security issues were fixed:\n- CVE-2015-3281: Information disclosure (bsc#937042).\n- CVE-2015-4000: The Logjam Attack / weakdh.org (bsc#937202).\n  ","status":"published","published":"2015-07-08T15:49:48Z","modified":"2026-02-04T03:29:16.579789Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1776-1","title":"Security update for haproxy","description":"\nhaxproy was updated to backport various security fixes and related patches (bsc#937202) (bsc#937042) (CVE-2015-3281)\n\n+ BUG/MAJOR: buffers: make the buffer_slow_realign() function respect output data\n+ BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id\n+ MEDIUM: ssl: replace standards DH groups with custom ones\n+ BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value being overwritten\n+ MINOR: ssl: add a destructor to free allocated SSL ressources\n+ BUG/MINOR: ssl: Display correct filename in error message\n+ MINOR: ssl: load certificates in alphabetical order\n+ BUG/MEDIUM: checks: fix conflicts between agent checks and ssl healthchecks\n+ BUG/MEDIUM: ssl: force a full GC in case of memory shortage\n+ BUG/MEDIUM: ssl: fix bad ssl context init can cause segfault in case of OOM.\n+ BUG/MINOR: ssl: correctly initialize ssl ctx for invalid certificates\n+ MINOR: ssl: add statement to force some ssl options in global.\n+ MINOR: ssl: add fetchs 'ssl_c_der' and 'ssl_f_der' to return DER formatted certs\n\nAlso the init script was fixed for the haproxy status checks (bsc#947204)\n ","status":"published","published":"2015-09-25T13:22:07Z","modified":"2026-02-04T02:39:23.837452Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-3281","description":"The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.","status":"withdrawn","published":"2015-07-06T00:00:00Z","modified":"2026-02-04T02:23:01.289483Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}