Vulnerability Details : CVE-2015-3195
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
Vulnerability category: Information leak
Products affected by CVE-2015-3195
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*
- cpe:2.3:a:oracle:http_server:11.5.10.2:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*
- Oracle » Integrated Lights Out Manager FirmwareVersions from including (>=) 3.0 and up to, including, (<=) 4.0.4cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:transportation_management:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:transportation_management:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:exalogic_infrastructure:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:exalogic_infrastructure:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:api_gateway:11.1.2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:life_sciences_data_hub:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:sun_ray_software:11.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:*
- cpe:2.3:a:oracle:communications_webrtc_session_controller:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_webrtc_session_controller:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-3195
4.58%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-3195
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2015-3195
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-3195
-
http://www.fortiguard.com/advisory/openssl-advisory-december-2015
FortiGuardBroken Link
-
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
Oracle Critical Patch Update - January 2016Third Party Advisory
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733
Juniper Networks - 2016-04 Security Bulletin: ScreenOS: Multiple Vulnerabilities in OpenSSLThird Party Advisory
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
Juniper Networks - 2016-10 Security Bulletin: CTPView: Multiple vulnerabilities in CTPViewThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
[security-announce] openSUSE-SU-2016:0640-1: important: Security updateMailing List;Third Party Advisory
-
http://marc.info/?l=bugtraq&m=145382583417444&w=2
'[security bulletin] HPSBGN03536 rev.1 - HP IceWall Products running OpenSSL, Remote and Local Denial' - MARCMailing List;Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-2056.html
Red Hat Customer PortalBroken Link
-
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
cpuapr2016v3Third Party Advisory
-
https://git.openssl.org/?p=openssl.git;a=commit;h=cc598f321fbac9c04da5766243ed55d55948637d
git.openssl.org Git - openssl.git/commitPatch;Vendor Advisory
-
http://www.securityfocus.com/bid/91787
Oracle July 2016 Critical Patch Update Multiple VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
Oracle Critical Patch Update - January 2018Third Party Advisory
-
http://www.securitytracker.com/id/1034294
OpenSSL Multiple Bugs Let Remote Users Deny Service and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
http://rhn.redhat.com/errata/RHSA-2016-2957.html
RHSA-2016:2957 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00103.html
openSUSE-SU-2015:2349-1: moderate: Security update for compat-openssl098Mailing List;Third Party Advisory
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
HPSBMU03611 rev.2 - HPE Matrix Operating Environment on Windows and Linux, Multiple Remote VulnerabilitiesThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-2616.html
RHSA-2015:2616 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173
HPSBGN03536 rev.1 - HP IceWall Products running OpenSSL, Remote and Local Denial of Service (DoS)Third Party Advisory
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
HPSBMU03593 rev.2 - HPE System Management Homepage (SMH), Remote Code Execution, Denial of Service (DoS), Disclosure of Sensitive InformationThird Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00071.html
openSUSE-SU-2015:2289-1: moderate: Security update for opensslMailing List;Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-2617.html
RHSA-2015:2617 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Oracle Critical Patch Update - October 2017Third Party Advisory
-
https://support.apple.com/HT206167
About the security content of OS X El Capitan v10.11.4 and Security Update 2016-002 - Apple SupportThird Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Oracle Critical Patch Update - July 2016Third Party Advisory
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
Oracle Linux Bulletin - October 2015Third Party Advisory
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085
HPSBMU03590 rev.3 - HPE Systems Insight Manager (SIM), Multiple Remote VulnerabilitiesThird Party Advisory
-
http://openssl.org/news/secadv/20151203.txt
Vendor Advisory
-
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100
Pulse Security Advisory: SA40100 - [Pulse Secure] December 3rd 2015 OpenSSL Security AdvisoryThird Party Advisory
-
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
Oracle Solaris Bulletin - January 2016Third Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Oracle Critical Patch Update - October 2016Third Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00070.html
openSUSE-SU-2015:2288-1: moderate: Security update for OpenSSLMailing List;Third Party Advisory
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322
SorryThird Party Advisory
-
http://www.securityfocus.com/bid/78626
OpenSSL CVE-2015-3195 Information Disclosure VulnerabilityThird Party Advisory;VDB Entry
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html
[security-announce] openSUSE-SU-2016:0637-1: important: Security updateMailing List;Third Party Advisory
-
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
Apple - Lists.apple.comMailing List;Third Party Advisory
-
http://www.debian.org/security/2015/dsa-3413
Debian -- Security Information -- DSA-3413-1 opensslThird Party Advisory
-
http://fortiguard.com/advisory/openssl-advisory-december-2015
FortiGuardBroken Link
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
HPSBMU03612 rev.2 - HPE Insight Control on Windows and Linux, Multiple Remote VulnerabilitiesThird Party Advisory
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016Third Party Advisory
-
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html
[security-announce] SUSE-SU-2016:0678-1: important: Security update forMailing List;Third Party Advisory
-
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583
The Slackware Linux Project: Slackware Security AdvisoriesThird Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00087.html
openSUSE-SU-2015:2318-1: moderate: Security update for libresslMailing List;Third Party Advisory
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
Juniper Networks - 2016-10 Security Bulletin: OpenSSL security updatesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2830-1
USN-2830-1: OpenSSL vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Oracle Critical Patch Update - July 2017Third Party Advisory
-
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl
Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco ProductsThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.html
[SECURITY] Fedora 22 Update: openssl-1.0.1k-13.fc22Third Party Advisory
Jump to