CVE-2015-1789

EPSS 74.48%
Veröffentlicht 12.06.2015 19:59:02
Zuletzt bearbeitet 06.05.2026 22:30:45
Erkennungen
Login

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 58

NVD 46 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

OpenSSL ≫ OpenSSL Version <= 0.9.8zf

OpenSSL ≫ OpenSSL Version 1.0.0

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta1

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta2

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta3

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta4

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta5

OpenSSL ≫ OpenSSL Version 1.0.0a

OpenSSL ≫ OpenSSL Version 1.0.0b

OpenSSL ≫ OpenSSL Version 1.0.0c

OpenSSL ≫ OpenSSL Version 1.0.0d

OpenSSL ≫ OpenSSL Version 1.0.0e

OpenSSL ≫ OpenSSL Version 1.0.0f

OpenSSL ≫ OpenSSL Version 1.0.0g

OpenSSL ≫ OpenSSL Version 1.0.0h

OpenSSL ≫ OpenSSL Version 1.0.0i

OpenSSL ≫ OpenSSL Version 1.0.0j

OpenSSL ≫ OpenSSL Version 1.0.0k

OpenSSL ≫ OpenSSL Version 1.0.0l

OpenSSL ≫ OpenSSL Version 1.0.0m

OpenSSL ≫ OpenSSL Version 1.0.0n

OpenSSL ≫ OpenSSL Version 1.0.0o

OpenSSL ≫ OpenSSL Version 1.0.0p

OpenSSL ≫ OpenSSL Version 1.0.0q

OpenSSL ≫ OpenSSL Version 1.0.0r

OpenSSL ≫ OpenSSL Version 1.0.1

OpenSSL ≫ OpenSSL Version 1.0.1 Update beta1

OpenSSL ≫ OpenSSL Version 1.0.1 Update beta2

OpenSSL ≫ OpenSSL Version 1.0.1 Update beta3

OpenSSL ≫ OpenSSL Version 1.0.1a

OpenSSL ≫ OpenSSL Version 1.0.1b

OpenSSL ≫ OpenSSL Version 1.0.1c

OpenSSL ≫ OpenSSL Version 1.0.1d

OpenSSL ≫ OpenSSL Version 1.0.1e

OpenSSL ≫ OpenSSL Version 1.0.1f

OpenSSL ≫ OpenSSL Version 1.0.1g

OpenSSL ≫ OpenSSL Version 1.0.1h

OpenSSL ≫ OpenSSL Version 1.0.1i

OpenSSL ≫ OpenSSL Version 1.0.1j

OpenSSL ≫ OpenSSL Version 1.0.1k

OpenSSL ≫ OpenSSL Version 1.0.1l

OpenSSL ≫ OpenSSL Version 1.0.1m

OpenSSL ≫ OpenSSL Version 1.0.2

OpenSSL ≫ OpenSSL Version 1.0.2 Update beta1

OpenSSL ≫ OpenSSL Version 1.0.2a

Oracle ≫ Sparc-opl Service Processor Version <= 1121

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	74.48%	0.994

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

https://support.apple.com/kb/HT205031

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

http://marc.info/?l=bugtraq&m=144050155601375&w=2

http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

https://support.citrix.com/article/CTX216642

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html

http://www.securityfocus.com/bid/91787

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html

http://marc.info/?l=bugtraq&m=143880121627664&w=2

http://rhn.redhat.com/errata/RHSA-2015-1197.html

http://www.debian.org/security/2015/dsa-3287

https://bto.bluecoat.com/security-advisory/sa98

https://kc.mcafee.com/corporate/index?page=content&id=SB10122

https://openssl.org/news/secadv/20150611.txt

https://security.gentoo.org/glsa/201506-02

https://www.openssl.org/news/secadv_20150611.txt

Vendor Advisory

http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015

http://rhn.redhat.com/errata/RHSA-2015-1115.html

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl

http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015

http://www.securitytracker.com/id/1032564

http://www.ubuntu.com/usn/USN-2639-1

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694

http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160436.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160647.html

http://marc.info/?l=bugtraq&m=143654156615516&w=2

http://www.securityfocus.com/bid/75156

https://github.com/openssl/openssl/commit/f48b83b4fb7d6689584cf25f61ca63a4891f5b11

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05353965

https://www.arista.com/en/support/advisories-notices/security-advisories/1144-security-advisory-11

https://nvd.nist.gov/vuln/detail/CVE-2015-1789

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-1789

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-1789

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2015-1789