CVE-2015-0292

openssl: integer underflow leading to buffer overflow in base64 decoding

Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.

CVSS 2.0 · 7.5 High EPSS 42.5% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Storage

CVE-2015-0291

openssl: ClientHello sigalgs NULL pointer dereference DoS

The sigalgs implementation in t1_lib.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by using an invalid signature_algorithms extension in the ClientHello message during a renegotiation.

CVSS 2.0 · 5.0 Medium EPSS 6.9% KEV · Not listed

Vendors

Openssl

Products

Openssl

CVE-2015-0290

openssl: multiblock corrupted pointer

The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non-blocking I/O cases, which allows remote attackers to cause a denial of service (pointer corruption and application crash) via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 6.5% KEV · Not listed

Vendors

Openssl

Products

Openssl

CVE-2015-0289

openssl: PKCS7 NULL pointer dereference

The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.

CVSS 2.0 · 5.0 Medium EPSS 8.6% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Storage

CVE-2015-0288

openssl: X509_to_X509_REQ NULL pointer dereference

The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Web Server and 1 more

CVE-2015-0287

openssl: ASN.1 structure reuse memory corruption

The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.

CVSS 2.0 · 5.0 Medium EPSS 8.6% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Storage

CVE-2015-0286

openssl: invalid pointer use in ASN1_TYPE_cmp()

The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.

CVSS 2.0 · 5.0 Medium EPSS 19.9% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Core Services and 1 more

CVE-2015-0285

openssl: handshake with unseeded PRNG

The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force attack.

CVSS 2.0 · 4.3 Medium EPSS 5.0% KEV · Not listed

Vendors

Openssl

Products

Openssl

CVE-2015-0209

openssl: use-after-free on invalid EC private key import

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

CVSS 2.0 · 6.8 Medium EPSS 16.4% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Core Services and 2 more

CVE-2015-0208

openssl: segmentation fault for invalid PSS parameters

The ASN.1 signature-verification implementation in the rsa_item_verify function in crypto/rsa/rsa_ameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted RSA PSS parameters to an endpoint that uses the certificate-verification feature.

CVSS 2.0 · 4.3 Medium EPSS 29.5% KEV · Not listed

Vendors

Openssl

Products

Openssl

CVE-2015-0207

openssl: DTLS segmentation fault in DTLSv1_listen

The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.

CVSS 2.0 · 5.0 Medium EPSS 6.5% KEV · Not listed

Vendors

Openssl

Products

Openssl

CVE-2015-0206

openssl: DTLS memory leak in dtls1_buffer_record

Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.

CVSS 2.0 · 5.0 Medium EPSS 57.4% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux

CVE-2015-0205

openssl: DH client certificates accepted without verification

The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.

CVSS 2.0 · 5.0 Medium EPSS 22.3% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux

CVE-2014-8275

openssl: Fix various certificate fingerprint issues

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

CVSS 2.0 · 5.0 Medium EPSS 15.0% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux

CVE-2014-8176

OpenSSL: Invalid free in DTLS

The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.

CVSS 3.0 · 7.5 High EPSS 16.6% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Core Services

CVE-2014-5139

openssl: crash with SRP ciphersuite in Server Hello message

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

CVSS 2.0 · 4.3 Medium EPSS 16.3% KEV · Not listed

Vendors

Openssl

Products

Openssl

CVE-2014-3572

openssl: ECDH downgrade bug fix

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.

CVSS 2.0 · 5.0 Medium EPSS 6.2% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux

CVE-2014-3571

openssl: DTLS segmentation fault in dtls1_get_record

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.

CVSS 2.0 · 5.0 Medium EPSS 22.1% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux

CVE-2014-3570

openssl: Bignum squaring may produce incorrect results

The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.

CVSS 3.0 · 3.7 Low EPSS 21.9% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Application Platform and 1 more

CVE-2014-3569

openssl: denial of service in ssl23_get_client_hello function

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix.

CVSS 2.0 · 5.0 Medium EPSS 19.5% KEV · Not listed

Vendors

Openssl

Products

Openssl