Published: 09/01/2015 Updated: 15/11/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

OpenSSL prior to 0.9.8zd, 1.0.0 prior to 1.0.0p, and 1.0.1 prior to 1.0.1k does not enforce certain constraints on certificate data, which allows remote malicious users to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl
openssl openssl 1.0.0g
openssl openssl 1.0.0h
openssl openssl 1.0.1j
openssl openssl 1.0.1i
openssl openssl 1.0.1b
openssl openssl 1.0.1a
openssl openssl 1.0.0c
openssl openssl 1.0.0d
openssl openssl 1.0.0k
openssl openssl 1.0.0l
openssl openssl 1.0.1f
openssl openssl 1.0.1e
openssl openssl 1.0.0e
openssl openssl 1.0.0f
openssl openssl 1.0.0m
openssl openssl 1.0.0n
openssl openssl 1.0.0o
openssl openssl 1.0.1d
openssl openssl 1.0.1c
openssl openssl 1.0.0a
openssl openssl 1.0.0b
openssl openssl 1.0.0i
openssl openssl 1.0.0j
openssl openssl 1.0.1h
openssl openssl 1.0.1g

Synopsis Moderate: openssl security update Type/Severity Security Advisory: Moderate Topic Updated openssl packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 6 and 7Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability S ...

Several security issues were fixed in OpenSSL ...

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2014-3569 Frank Schmirler reported that the ssl23_get_client_hello function in OpenSSL does not properly handle attempts to use unsupported protocols When OpenS ...

OpenSSL before 098zd, 100 before 100p, and 101 before 101k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_p ...

Multiple flaws were found in the way OpenSSL parsed X509 certificates An attacker could use these flaws to modify an X509 certificate to produce a certificate with a different fingerprint without invalidating its signature, and possibly bypass fingerprint-based blacklisting in applications ...

Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service condition or perform a man-in-the-middle attack On January 8, 2015, the OpenSSL Project released a security advisory detailing eight distinct vulnerabilities ...

Nessus is potentially impacted by seven vulnerabilities in OpenSSL that were recently disclosed and fixed OpenSSL contains an invalid read flaw in the ASN1_TYPE_cmp() function in crypto/asn1/a_typec that is triggered when an attempt is made to compare ASN1 boolean types This may allow a context-dependent attacker to crash an application linked ...

Description of Problem A number of security vulnerabilities have been identified in firmware used in the Lights Out Management (LOM) component across all NetScaler-based hardware appliances: Citrix NetScaler Application Delivery Controller (ADC) Citrix NetScaler Gateway Citrix NetScaler Service Delivery Appliance Citrix CloudBridge (now NetScaler S ...

JPN_RIC13351-2 VxWorks 61 Support for CVE-2015-0205, CVE-2014-3572, CVE-2015-0204, CVE-2014-8275, CVE-2014-8275 Feb-Apr 2015 See docs/JPN_RIC13351-2_HowTo_Install_Build_Test_v07docx for detailed instructions

CVE-2014-8275

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect