KLA10460
Multiple vulnerabilities in OpenSSL
Updated: 06/01/2019
Detect date
?
01/08/2015
Severity
?
Warning
Description

Multiple serious vulnerabilities have been found in OpenSSL. Malicious users can exploit these vulnerabilities to cause denial of service or bypass security restrictions.

Below is a complete list of vulnerabilities pppeep

  1. An unknown vulnerability can be exploited remotely via specially designed DTLS message;
  2. Improper calculations can be exploited remotely via unspecified vectors;
  3. An unknown vulnerability can be exploited remotely via unspecified vectors related to ServerKeyExchange, fingerprint-based certificate-blacklist, Diffie-Hellman certificate;
  4. Lack of protocol checking can be exploited remotely via unexpected handshake;
  5. An unknown vulnerability can be exploited remotely via RSA-to-EXPORT_RSA downgrade attacks;
  6. Memory leak can be exploited remotely via specially designed records.
Affected products

OpenSSL versions earlier than 0.9.8zd
OpenSSL 1.0.0 versions earlier than 1.0.0p
OpenSSL 1.0.1 versions earlier than 1.0.1k

Solution

Update to latest version!

Original advisories

OpenSSL bulletin

Impacts
?
ACE 
[?]

OSI 
[?]

DoS 
[?]

SB 
[?]

LoI 
[?]
CVE-IDS
?
CVE-2014-35715.0Critical
CVE-2014-82755.0Critical
CVE-2014-35695.0Critical
CVE-2014-35725.0Critical
CVE-2014-35705.0Critical
CVE-2015-02065.0Critical
CVE-2015-02044.3Warning
CVE-2015-02055.0Critical