Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2015-3196

Published: 06/12/2015 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Subscribe to Hp

Vulnerability Summary

ssl/s3_clnt.c in OpenSSL 1.0.0 prior to 1.0.0t, 1.0.1 prior to 1.0.1p, and 1.0.2 prior to 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.

Vulnerable Product Search on Vulmon Subscribe to Product

hp icewall sso 10.0

hp icewall sso agent option 10.0

openssl openssl 1.0.1m

openssl openssl 1.0.1j

openssl openssl 1.0.0n

openssl openssl 1.0.0c

openssl openssl 1.0.0i

openssl openssl 1.0.1h

openssl openssl 1.0.0m

openssl openssl 1.0.1c

openssl openssl 1.0.1g

openssl openssl 1.0.0h

openssl openssl 1.0.0e

openssl openssl 1.0.0f

openssl openssl 1.0.0d

openssl openssl 1.0.0j

openssl openssl 1.0.0p

openssl openssl 1.0.1a

openssl openssl 1.0.0s

openssl openssl 1.0.0o

openssl openssl 1.0.1d

openssl openssl 1.0.0k

openssl openssl 1.0.1k

openssl openssl 1.0.0

openssl openssl 1.0.1b

openssl openssl 1.0.1n

openssl openssl 1.0.1e

openssl openssl 1.0.1l

openssl openssl 1.0.1f

openssl openssl 1.0.0l

openssl openssl 1.0.1o

openssl openssl 1.0.0r

openssl openssl 1.0.0a

openssl openssl 1.0.0q

openssl openssl 1.0.1i

openssl openssl 1.0.0b

openssl openssl 1.0.1

openssl openssl 1.0.0g

oracle vm virtualbox

redhat enterprise linux desktop 7.0

redhat enterprise linux server aus 7.2

redhat enterprise linux workstation 7.0

redhat enterprise linux server tus 7.2

fedoraproject fedora 22

redhat enterprise linux server 7.0

redhat enterprise linux server eus 7.2

redhat enterprise linux desktop 6.0

redhat enterprise linux server 6.0

redhat enterprise linux workstation 6.0

redhat enterprise linux server tus 7.3

redhat enterprise linux server aus 7.3

redhat enterprise linux server aus 7.4

redhat enterprise linux server eus 7.3

redhat enterprise linux server eus 7.4

redhat enterprise linux server eus 7.5

redhat enterprise linux server eus 6.7

redhat enterprise linux server tus 7.6

redhat enterprise linux server eus 7.6

canonical ubuntu linux 12.04

debian debian linux 8.0

debian debian linux 7.0

canonical ubuntu linux 15.10

canonical ubuntu linux 14.04

canonical ubuntu linux 15.04

Vendor Advisories

Red Hat: Moderate: openssl security update
Synopsis Moderate: openssl security update Type/Severity Security Advisory: Moderate Topic Updated openssl packages that fix three security issues are now availablefor Red Hat Enterprise Linux 6 and 7Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scor ...
Red Hat: Important: Red Hat JBoss Core Services Apache HTTP 2.4.23 Release
Synopsis Important: Red Hat JBoss Core Services Apache HTTP 2423 Release Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services httpd 2423 is now available from the Red Hat Customer Portal for Solaris and Microsoft Windows systemsRed Hat Product Security has rated this release as ...
Ubuntu Security Notice: openssl vulnerabilities
Several security issues were fixed in OpenSSL ...
Debian Security Advisories: DSA-3413-1 openssl -- security update
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2015-3194 Loic Jonas Etienne of Qnective AG discovered that the signature verification routines will crash with a NULL pointer dereference if presented with an A ...
Amazon Linux AMI: ALAS-2015-614
A NULL pointer derefernce flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm A remote attacked could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication (CVE-2015-3194) A memory leak vulnerability was found in the way OpenSSL parsed PK ...
Red Hat: CVE-2015-3196
A race condition flaw, leading to a double free, was found in the way OpenSSL handled pre-shared key (PSK) identify hints A remote attacker could use this flaw to crash a multi-threaded SSL/TLS client using OpenSSL ...
Cisco: Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products
On December 3, 2015, the OpenSSL Project released a security advisory detailing five vulnerabilities Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition This advisory will be updated as addi ...

ICS Advisories

Siemens SCALANCE X-200RNA Switch Devices

References

CWE-362http://openssl.org/news/secadv/20151203.txthttps://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://marc.info/?l=bugtraq&m=145382583417444&w=2https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlhttp://www.securityfocus.com/bid/78622http://fortiguard.com/advisory/openssl-advisory-december-2015http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-opensslhttp://rhn.redhat.com/errata/RHSA-2015-2617.htmlhttp://www.fortiguard.com/advisory/openssl-advisory-december-2015http://www.ubuntu.com/usn/USN-2830-1http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.htmlhttp://www.debian.org/security/2015/dsa-3413http://lists.opensuse.org/opensuse-updates/2015-12/msg00070.htmlhttp://lists.opensuse.org/opensuse-updates/2015-12/msg00071.htmlhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322http://www.securitytracker.com/id/1034294https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttp://rhn.redhat.com/errata/RHSA-2016-2957.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttps://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3c66a669dfc7b3792f7af0758ea26fe8502ce70chttps://access.redhat.com/errata/RHSA-2015:2617https://nvd.nist.govhttps://usn.ubuntu.com/2830-1/https://access.redhat.com/security/cve/cve-2015-3196https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-21
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
deserializationCVE-2024-4040cross-site scriptingCVE-2023-25790CVE-2024-2961XML external entityCVE-2024-26926CVE-2024-32806CVE-2024-32711
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook