5
CVSSv2

CVE-2015-1794

Published: 06/12/2015 Updated: 14/09/2017
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 prior to 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.
Vulnerable Product Search on Vulmon Subscribe to Product

openssl openssl 1.0.2

openssl openssl 1.0.2a

openssl openssl 1.0.2b

openssl openssl 1.0.2c

openssl openssl 1.0.2d

Vendor Advisories

The ssl3_get_key_exchange function in ssl/s3_clntc in OpenSSL 102 before 102e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message ...
Several security issues were fixed in OpenSSL ...
On December 3, 2015, the OpenSSL Project released a security advisory detailing five vulnerabilities Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition  This advisory will be updated as add ...
<!-- Start - Changes for Security Advisory Channel --> Security Advisory ID SYMSA1338 Initial Publication Date: Advisory Status: Advisory Severity: CVSS Base Score: Legacy ID 10 Dec 2015 Open Medium CVSS v2: 50 SA1 ...
Oracle Critical Patch Update Advisory - April 2016 Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory ...

Recent Articles

OopSSL: Pushme-Pullyou for OpenSSL patches
The Register • Richard Chirgwin • 06 Dec 2015

Version control, we've heard of it

The OpenSSL Project released its promised updates last week and, almost immediately, had to try again because of errors in the release.
The bugs fixed in the release include three moderate-level issues and one low-severity bug. They include denial-of-service vulnerability by crashing OpenSSL clients during certificate verification.
The fixes apply to OpenSSL 0.9.8zh, 1.0.0t, 1.0.1q and 1.0.2e branches. The 1.0.0 and 0.9.8 branches have been on OpenSSL's end-of-life list since Decembe...

OopSSL: Pushme-Pullyou for OpenSSL patches
The Register • Richard Chirgwin • 06 Dec 2015

Version control, we've heard of it

The OpenSSL Project released its promised updates last week and, almost immediately, had to try again because of errors in the release.
The bugs fixed in the release include three moderate-level issues and one low-severity bug. They include denial-of-service vulnerability by crashing OpenSSL clients during certificate verification.
The fixes apply to OpenSSL 0.9.8zh, 1.0.0t, 1.0.1q and 1.0.2e branches. The 1.0.0 and 0.9.8 branches have been on OpenSSL's end-of-life list since Decembe...