7.5 - DSA-3197

Executive Summary

Summary
Title	openssl regression update

Informations
Name	DSA-3197	First vendor Publication	2015-03-19
Vendor	Debian	Last vendor Modification	2015-03-24
Severity (Vendor)	N/A	Revision	2

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The openssl update issued as DSA 3197-1 caused regressions. This update reverts the defective patch applied in that update causing these problems. Additionally a follow-up fix for CVE-2015-0209 is applied. For reference the original advisory text follows.

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues:

CVE-2015-0286

Stephen Henson discovered that the ASN1_TYPE_cmp() function can be crashed, resulting in denial of service.

CVE-2015-0287

Emilia Kaesper discovered a memory corruption in ASN.1 parsing.

CVE-2015-0289

Michal Zalewski discovered a NULL pointer dereference in the PKCS#7 parsing code, resulting in denial of service.

CVE-2015-0292

It was discovered that missing input sanitising in base64 decoding might result in memory corruption.

CVE-2015-0209

It was discovered that a malformed EC private key might result in memory corruption.

CVE-2015-0288

It was discovered that missing input sanitising in the X509_to_X509_REQ() function might result in denial of service.

For the stable distribution (wheezy), these problems have been fixed in version 1.0.1e-2+deb7u16.

We recommend that you upgrade your openssl packages.

Original Source

Url : http://www.debian.org/security/2015/dsa-3197

CWE : Common Weakness Enumeration

%	Id	Name
67 %	CWE-17	Code
33 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:28275

Oval ID:	oval:org.mitre.oval:def:28275
Title:	Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description:	Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0292	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.23 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.002 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.002 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.002 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.002 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.11 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.001 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.001 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.001 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.001 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.31 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.003 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.003 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.003 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.003

Definition Id: oval:org.mitre.oval:def:28477

Oval ID:	oval:org.mitre.oval:def:28477
Title:	Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description:	The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0289	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.23 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.002 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.002 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.002 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.002 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.11 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.001 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.001 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.001 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.001 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.31 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.003 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.003 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.003 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.003

Definition Id: oval:org.mitre.oval:def:28541

Oval ID:	oval:org.mitre.oval:def:28541
Title:	AIX OpenSSL Denial of Service (invalid write operation and memory corruption)
Description:	The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0287	Version:	4
Platform(s):	IBM AIX 6.1 IBM AIX 7.1	Product(s):
Definition Synopsis:
platforms IBM AIX 6.1 is installed AND IBM AIX 7.1 is installed AND filesets File Version Exists openssl.base greater than or equal 1.0.1.500 AND openssl.base less than or equal 1.0.1.513 AND File Version Exists openssl.base greater than or equal 0.9.8.401 AND openssl.base less than or equal 0.9.8.2504 AND File Version Exists openssl.base greater than or equal 12.9.8.1100 AND openssl.base less than or equal 12.9.8.2504

Definition Id: oval:org.mitre.oval:def:28557

Oval ID:	oval:org.mitre.oval:def:28557
Title:	Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description:	Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0209	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.23 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.002 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.002 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.002 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.002 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.11 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.001 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.001 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.001 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.001 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.31 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.003 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.003 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.003 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.003

Definition Id: oval:org.mitre.oval:def:28671

Oval ID:	oval:org.mitre.oval:def:28671
Title:	AIX OpenSSL Denial of Service (NULL pointer dereference and application crash)
Description:	The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0289	Version:	4
Platform(s):	IBM AIX 6.1 IBM AIX 7.1	Product(s):
Definition Synopsis:
platforms IBM AIX 6.1 is installed AND IBM AIX 7.1 is installed AND filesets File Version Exists openssl.base greater than or equal 1.0.1.500 AND openssl.base less than or equal 1.0.1.513 AND File Version Exists openssl.base greater than or equal 0.9.8.401 AND openssl.base less than or equal 0.9.8.2504 AND File Version Exists openssl.base greater than or equal 12.9.8.1100 AND openssl.base less than or equal 12.9.8.2504

Definition Id: oval:org.mitre.oval:def:28785

Oval ID:	oval:org.mitre.oval:def:28785
Title:	AIX OpenSSL Denial of Service (NULL pointer dereference and application crash)
Description:	The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0288	Version:	4
Platform(s):	IBM AIX 6.1 IBM AIX 7.1	Product(s):
Definition Synopsis:
platforms IBM AIX 6.1 is installed AND IBM AIX 7.1 is installed AND filesets File Version Exists openssl.base greater than or equal 1.0.1.500 AND openssl.base less than or equal 1.0.1.513 AND File Version Exists openssl.base greater than or equal 0.9.8.401 AND openssl.base less than or equal 0.9.8.2504 AND File Version Exists openssl.base greater than or equal 12.9.8.1100 AND openssl.base less than or equal 12.9.8.2504

Definition Id: oval:org.mitre.oval:def:28791

Oval ID:	oval:org.mitre.oval:def:28791
Title:	Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description:	The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0287	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.23 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.002 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.002 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.002 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.002 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.11 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.001 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.001 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.001 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.001 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.31 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.003 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.003 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.003 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.003

Definition Id: oval:org.mitre.oval:def:28795

Oval ID:	oval:org.mitre.oval:def:28795
Title:	AIX OpenSSL Denial of Service (memory corruption and application crash)
Description:	Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0209	Version:	4
Platform(s):	IBM AIX 6.1 IBM AIX 7.1	Product(s):
Definition Synopsis:
platforms IBM AIX 6.1 is installed AND IBM AIX 7.1 is installed AND filesets File Version Exists openssl.base greater than or equal 1.0.1.500 AND openssl.base less than or equal 1.0.1.513 AND File Version Exists openssl.base greater than or equal 0.9.8.401 AND openssl.base less than or equal 0.9.8.2504 AND File Version Exists openssl.base greater than or equal 12.9.8.1100 AND openssl.base less than or equal 12.9.8.2504

Definition Id: oval:org.mitre.oval:def:28799

Oval ID:	oval:org.mitre.oval:def:28799
Title:	Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description:	The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0288	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.23 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.002 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.002 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.002 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.002 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.11 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.001 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.001 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.001 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.001 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.31 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.003 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.003 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.003 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.003

Definition Id: oval:org.mitre.oval:def:28833

Oval ID:	oval:org.mitre.oval:def:28833
Title:	AIX OpenSSL Denial of Service (invalid read operation and application crash)
Description:	The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0286	Version:	4
Platform(s):	IBM AIX 6.1 IBM AIX 7.1	Product(s):
Definition Synopsis:
platforms IBM AIX 6.1 is installed AND IBM AIX 7.1 is installed AND filesets File Version Exists openssl.base greater than or equal 1.0.1.500 AND openssl.base less than or equal 1.0.1.513 AND File Version Exists openssl.base greater than or equal 0.9.8.401 AND openssl.base less than or equal 0.9.8.2504 AND File Version Exists openssl.base greater than or equal 12.9.8.1100 AND openssl.base less than or equal 12.9.8.2504

Definition Id: oval:org.mitre.oval:def:28905

Oval ID:	oval:org.mitre.oval:def:28905
Title:	AIX OpenSSL Denial of Service (memory corruption)
Description:	Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0292	Version:	4
Platform(s):	IBM AIX 6.1 IBM AIX 7.1	Product(s):
Definition Synopsis:
platforms IBM AIX 6.1 is installed AND IBM AIX 7.1 is installed AND filesets File Version Exists openssl.base greater than or equal 1.0.1.500 AND openssl.base less than or equal 1.0.1.513 AND File Version Exists openssl.base greater than or equal 0.9.8.401 AND openssl.base less than or equal 0.9.8.2504 AND File Version Exists openssl.base greater than or equal 12.9.8.1100 AND openssl.base less than or equal 12.9.8.2504

Definition Id: oval:org.mitre.oval:def:28933

Oval ID:	oval:org.mitre.oval:def:28933
Title:	Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description:	The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2015-0286	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.23 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.002 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.002 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.002 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.002 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.002 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.002 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.002 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.11 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.001 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.001 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.001 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.001 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.001 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.001 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.001 OR Criteria meets HP Security Bulletin HPSBUX03334 HP-UX B.11.31 AND filesets tests openssl.OPENSSL-PVT version is less than A.00.09.08zf.003 AND openssl.OPENSSL-RUN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CER version is less than A.00.09.08zf.003 AND openssl.OPENSSL-CONF version is less than A.00.09.08zf.003 AND openssl.OPENSSL-DOC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-INC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-LIB version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MAN version is less than A.00.09.08zf.003 AND openssl.OPENSSL-SRC version is less than A.00.09.08zf.003 AND openssl.OPENSSL-MIS version is less than A.00.09.08zf.003 AND openssl.OPENSSL-PRNG version is less than A.00.09.08zf.003

CPE : Common Platform Enumeration

Type	Description	Count
Application	Openssl cpe:2.3:a:openssl:openssl:1.0.2:-:::::: cpe:2.3:a:openssl:openssl:1.0.1l:::::::* cpe:2.3:a:openssl:openssl:1.0.1k:::::::* cpe:2.3:a:openssl:openssl:1.0.1j:::::::* cpe:2.3:a:openssl:openssl:1.0.1i:::::::* cpe:2.3:a:openssl:openssl:1.0.1h:::::::* cpe:2.3:a:openssl:openssl:1.0.1g:::::::* cpe:2.3:a:openssl:openssl:1.0.1f:::::::* cpe:2.3:a:openssl:openssl:1.0.1e:::::::* cpe:2.3:a:openssl:openssl:1.0.1d:::::::* cpe:2.3:a:openssl:openssl:1.0.1c:::::::* cpe:2.3:a:openssl:openssl:1.0.1b:::::::* cpe:2.3:a:openssl:openssl:1.0.1a:::::::* cpe:2.3:a:openssl:openssl:1.0.1:-:::::: cpe:2.3:a:openssl:openssl:1.0.0q:::::::* cpe:2.3:a:openssl:openssl:1.0.0p:::::::* cpe:2.3:a:openssl:openssl:1.0.0o:::::::* cpe:2.3:a:openssl:openssl:1.0.0n:::::::* cpe:2.3:a:openssl:openssl:1.0.0m:::::::* cpe:2.3:a:openssl:openssl:1.0.0l:::::::* cpe:2.3:a:openssl:openssl:1.0.0k:::::::* cpe:2.3:a:openssl:openssl:1.0.0j:::::::* cpe:2.3:a:openssl:openssl:1.0.0i:::::::* cpe:2.3:a:openssl:openssl:1.0.0h:::::::* cpe:2.3:a:openssl:openssl:1.0.0g:::::::* cpe:2.3:a:openssl:openssl:1.0.0f:::::::* cpe:2.3:a:openssl:openssl:1.0.0e:::::::* cpe:2.3:a:openssl:openssl:1.0.0d:::::::* cpe:2.3:a:openssl:openssl:1.0.0c:::::::* cpe:2.3:a:openssl:openssl:1.0.0b:::::::* cpe:2.3:a:openssl:openssl:1.0.0a:::::::* cpe:2.3:a:openssl:openssl:1.0.0:-:::::: cpe:2.3:a:openssl:openssl:0.9.8zg:::::::* cpe:2.3:a:openssl:openssl:0.9.8zf:::::::* cpe:2.3:a:openssl:openssl:0.9.8ze:::::::* cpe:2.3:a:openssl:openssl:0.9.8zc:::::::* cpe:2.3:a:openssl:openssl:0.9.8zb:::::::* cpe:2.3:a:openssl:openssl:0.9.8za:::::::* cpe:2.3:a:openssl:openssl:0.9.8z:::::::* cpe:2.3:a:openssl:openssl:0.9.8y:::::::* cpe:2.3:a:openssl:openssl:0.9.8x:::::::* cpe:2.3:a:openssl:openssl:0.9.8w:::::::* cpe:2.3:a:openssl:openssl:0.9.8v:::::::* cpe:2.3:a:openssl:openssl:0.9.8u:::::::* cpe:2.3:a:openssl:openssl:0.9.8t:::::::* cpe:2.3:a:openssl:openssl:0.9.8s:::::::* cpe:2.3:a:openssl:openssl:0.9.8r:::::::* cpe:2.3:a:openssl:openssl:0.9.8q:::::::* cpe:2.3:a:openssl:openssl:0.9.8o:::::::* cpe:2.3:a:openssl:openssl:0.9.8n:::::::* cpe:2.3:a:openssl:openssl:0.9.8m:-:::::: cpe:2.3:a:openssl:openssl:0.9.8m:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.8l:::::::* cpe:2.3:a:openssl:openssl:0.9.8k:::::::* cpe:2.3:a:openssl:openssl:0.9.8j:::::::* cpe:2.3:a:openssl:openssl:0.9.8i:::::::* cpe:2.3:a:openssl:openssl:0.9.8h:::::::* cpe:2.3:a:openssl:openssl:0.9.8g:::::::* cpe:2.3:a:openssl:openssl:0.9.8g::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.8g::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.8f:::::::* cpe:2.3:a:openssl:openssl:0.9.8f::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.8f::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.8f::::::x86: cpe:2.3:a:openssl:openssl:0.9.8e:::::::* cpe:2.3:a:openssl:openssl:0.9.8e::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.8e::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.8e::::::x86: cpe:2.3:a:openssl:openssl:0.9.8d:::::::* cpe:2.3:a:openssl:openssl:0.9.8d::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.8d::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.8d::::::x86: cpe:2.3:a:openssl:openssl:0.9.8c:::::::* cpe:2.3:a:openssl:openssl:0.9.8c::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.8c::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.8c::::::x86: cpe:2.3:a:openssl:openssl:0.9.7m:::::::* cpe:2.3:a:openssl:openssl:0.9.7m::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7m::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7m::::::x86: cpe:2.3:a:openssl:openssl:0.9.7l:::::::* cpe:2.3:a:openssl:openssl:0.9.7l::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7l::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7l::::::x86: cpe:2.3:a:openssl:openssl:0.9.7k:::::::* cpe:2.3:a:openssl:openssl:0.9.7k::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7k::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7k::::::x86: cpe:2.3:a:openssl:openssl:0.9.7j:::::::* cpe:2.3:a:openssl:openssl:0.9.7j::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7j::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7j::::::x86: cpe:2.3:a:openssl:openssl:0.9.7i:::::::* cpe:2.3:a:openssl:openssl:0.9.7i::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7i::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7i::::::x86: cpe:2.3:a:openssl:openssl:0.9.7h:::::::* cpe:2.3:a:openssl:openssl:0.9.7h::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7h::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7h::::::x86: cpe:2.3:a:openssl:openssl:0.9.7g:::::::* cpe:2.3:a:openssl:openssl:0.9.7g::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7g::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7g::::::x86: cpe:2.3:a:openssl:openssl:0.9.7f:::::::* cpe:2.3:a:openssl:openssl:0.9.7f::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7f::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7f::::::x86: cpe:2.3:a:openssl:openssl:0.9.7e:::::::* cpe:2.3:a:openssl:openssl:0.9.7e::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7e::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7e::::::x86: cpe:2.3:a:openssl:openssl:0.9.7d:::::::* cpe:2.3:a:openssl:openssl:0.9.7d::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7d::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7d::::::x86: cpe:2.3:a:openssl:openssl:0.9.7c:::::::* cpe:2.3:a:openssl:openssl:0.9.7c::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7c::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7c::::::x86: cpe:2.3:a:openssl:openssl:0.9.7b:::::::* cpe:2.3:a:openssl:openssl:0.9.7b::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7b::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7b::::::x86: cpe:2.3:a:openssl:openssl:0.9.7a:::::::* cpe:2.3:a:openssl:openssl:0.9.7a::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7a::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7a::::::x86: cpe:2.3:a:openssl:openssl:0.9.7:beta3:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.7:-:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta5:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta6:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta4:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.7:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta4:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta5:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta3:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.7:beta6:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta5:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta4:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta6:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta3:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.7::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.7::::::x86: cpe:2.3:a:openssl:openssl:0.9.7:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta3:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta4:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta5:::::x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta6:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6m:::::::* cpe:2.3:a:openssl:openssl:0.9.6m::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6m::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6m::::::x86: cpe:2.3:a:openssl:openssl:0.9.6l:::::::* cpe:2.3:a:openssl:openssl:0.9.6l::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6l::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6l::::::x86: cpe:2.3:a:openssl:openssl:0.9.6k:::::::* cpe:2.3:a:openssl:openssl:0.9.6k::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6k::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6k::::::x86: cpe:2.3:a:openssl:openssl:0.9.6j:::::::* cpe:2.3:a:openssl:openssl:0.9.6j::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6j::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6j::::::x86: cpe:2.3:a:openssl:openssl:0.9.6i:::::::* cpe:2.3:a:openssl:openssl:0.9.6i::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6i::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6i::::::x86: cpe:2.3:a:openssl:openssl:0.9.6h:::::::* cpe:2.3:a:openssl:openssl:0.9.6h:bogus:::::: cpe:2.3:a:openssl:openssl:0.9.6h::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6h::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6h::::::x86: cpe:2.3:a:openssl:openssl:0.9.6g:::::::* cpe:2.3:a:openssl:openssl:0.9.6g::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6g::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6g::::::x86: cpe:2.3:a:openssl:openssl:0.9.6f:::::::* cpe:2.3:a:openssl:openssl:0.9.6f::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6f::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6f::::::x86: cpe:2.3:a:openssl:openssl:0.9.6e:::::::* cpe:2.3:a:openssl:openssl:0.9.6e::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6e::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6e::::::x86: cpe:2.3:a:openssl:openssl:0.9.6d:-:::::: cpe:2.3:a:openssl:openssl:0.9.6d::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6d::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6d::::::x86: cpe:2.3:a:openssl:openssl:0.9.6c:::::::* cpe:2.3:a:openssl:openssl:0.9.6c::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6c::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6c::::::x86: cpe:2.3:a:openssl:openssl:0.9.6b:::::::* cpe:2.3:a:openssl:openssl:0.9.6b::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6b::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6b::::::x86: cpe:2.3:a:openssl:openssl:0.9.6a:-:::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta3:::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6a::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6a:beta3:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6a:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6a:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6a:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6a:beta3:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6a::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6a::::::x86: cpe:2.3:a:openssl:openssl:0.9.6a:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6a:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6a:beta3:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.6:-:::::: cpe:2.3:a:openssl:openssl:0.9.6:beta3:::::: cpe:2.3:a:openssl:openssl:0.9.6:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.6:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.6:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6:beta3:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.6:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6:beta3:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.6::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.6::::::x86: cpe:2.3:a:openssl:openssl:0.9.6:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.6:beta3:::::x86:* cpe:2.3:a:openssl:openssl:0.9.5a:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.5a:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.5a:-:::::: cpe:2.3:a:openssl:openssl:0.9.5a:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.5a::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.5a:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.5a::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.5a:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.5a:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.5a::::::x86: cpe:2.3:a:openssl:openssl:0.9.5a:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.5a:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.5:beta1:::::: cpe:2.3:a:openssl:openssl:0.9.5:-:::::: cpe:2.3:a:openssl:openssl:0.9.5:beta2:::::: cpe:2.3:a:openssl:openssl:0.9.5:beta2:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.5:beta1:%7E%7E%7E%7Ex86%7E:::::* cpe:2.3:a:openssl:openssl:0.9.5::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.5:beta1:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.5:beta2:~~~~x86~:::::* cpe:2.3:a:openssl:openssl:0.9.5::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.5::::::x86: cpe:2.3:a:openssl:openssl:0.9.5:beta1:::::x86:* cpe:2.3:a:openssl:openssl:0.9.5:beta2:::::x86:* cpe:2.3:a:openssl:openssl:0.9.4:::::::* cpe:2.3:a:openssl:openssl:0.9.4::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.4::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.4::::::x86: cpe:2.3:a:openssl:openssl:0.9.3a:::::::* cpe:2.3:a:openssl:openssl:0.9.3a::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.3a::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.3a::::::x86: cpe:2.3:a:openssl:openssl:0.9.3:-:::::: cpe:2.3:a:openssl:openssl:0.9.3::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.3::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.3::::::x86: cpe:2.3:a:openssl:openssl:0.9.2b:::::::* cpe:2.3:a:openssl:openssl:0.9.2b::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.2b::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.2b::::::x86: cpe:2.3:a:openssl:openssl:0.9.1c:::::::* cpe:2.3:a:openssl:openssl:0.9.1c::%7E%7E%7E%7Ex86%7E::::: cpe:2.3:a:openssl:openssl:0.9.1c::~~~~x86~::::: cpe:2.3:a:openssl:openssl:0.9.1c::::::x86: cpe:2.3:a:openssl:openssl:0.9.1b:::::::* cpe:2.3:a:openssl:openssl:0.9.0b:::::::* cpe:2.3:a:openssl:openssl:::::::: cpe:2.3:a:openssl:openssl:::openvms:::::* cpe:2.3:a:openssl:openssl:-:::::::*	286

Information Assurance Vulnerability Management (IAVM)

Date	Description
2015-09-24	IAVM : 2015-A-0222 - Multiple Security Vulnerabilities in Apple iOS Severity : Category I - VMSKEY : V0061471
2015-07-16	IAVM : 2015-A-0154 - Multiple Vulnerabilities in Oracle Fusion Middleware Severity : Category I - VMSKEY : V0061081
2015-07-16	IAVM : 2015-A-0160 - Multiple Vulnerabilities in Oracle Linux and Virtualization Severity : Category I - VMSKEY : V0061123
2015-06-25	IAVM : 2015-A-0135 - Multiple Vulnerabilities in Blue Coat ProxySG Severity : Category I - VMSKEY : V0060997

Snort® IPS/IDS

Date	Description
2015-07-19	OpenSSL denial-of-service via crafted x.509 certificate attempt RuleID : 34889 - Revision : 3 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date	Description
2016-04-14	Name : The remote device is missing a vendor-supplied security patch. File : cisco-sa-20150320-openssl-iosxe.nasl - Type : ACT_GATHER_INFO
2016-04-14	Name : The remote device is missing a vendor-supplied security patch. File : cisco-sa-20150320-openssl-ios.nasl - Type : ACT_GATHER_INFO
2016-03-29	Name : The remote web server is affected by multiple vulnerabilities. File : hpsmh_7_2_6.nasl - Type : ACT_GATHER_INFO
2016-03-08	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-0678-1.nasl - Type : ACT_GATHER_INFO
2016-03-04	Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-294.nasl - Type : ACT_GATHER_INFO
2016-02-26	Name : The remote device is missing a vendor-supplied security patch. File : cisco-sa-20140605-openssl-nxos.nasl - Type : ACT_GATHER_INFO
2016-01-28	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL16302.nasl - Type : ACT_GATHER_INFO
2015-12-30	Name : A web application on the remote host is affected by multiple vulnerabilities. File : puppet_enterprise_380.nasl - Type : ACT_GATHER_INFO
2015-12-21	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-2303-1.nasl - Type : ACT_GATHER_INFO
2015-12-17	Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-889.nasl - Type : ACT_GATHER_INFO
2015-10-22	Name : A web application running on the remote host is affected by multiple vulnerab... File : mysql_enterprise_monitor_3_0_23.nasl - Type : ACT_GATHER_INFO
2015-10-06	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL16323.nasl - Type : ACT_GATHER_INFO
2015-10-05	Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_10_11.nasl - Type : ACT_GATHER_INFO
2015-08-21	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-1410-1.nasl - Type : ACT_GATHER_INFO
2015-07-27	Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-507.nasl - Type : ACT_GATHER_INFO
2015-07-22	Name : The remote web server is affected by multiple vulnerabilities. File : hpsmh_7_5.nasl - Type : ACT_GATHER_INFO
2015-07-16	Name : The application installed on the remote host is affected by multiple vulnerab... File : oracle_secure_global_desktop_jul_2015_cpu.nasl - Type : ACT_GATHER_INFO
2015-07-01	Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_SecUpd2015-005.nasl - Type : ACT_GATHER_INFO
2015-07-01	Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_10_10_4.nasl - Type : ACT_GATHER_INFO
2015-06-25	Name : The remote device is affected by multiple vulnerabilities. File : bluecoat_proxy_sg_6_5_7_5.nasl - Type : ACT_GATHER_INFO
2015-06-16	Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2015-0070.nasl - Type : ACT_GATHER_INFO
2015-06-04	Name : The remote web server is running an application that is affected by multiple ... File : splunk_618.nasl - Type : ACT_GATHER_INFO
2015-05-20	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-0541-1.nasl - Type : ACT_GATHER_INFO
2015-05-19	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_7_0_60.nasl - Type : ACT_GATHER_INFO
2015-05-19	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_8_0_21.nasl - Type : ACT_GATHER_INFO
2015-05-15	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_6_0_44.nasl - Type : ACT_GATHER_INFO
2015-05-05	Name : The remote Fedora host is missing a security update. File : fedora_2015-6855.nasl - Type : ACT_GATHER_INFO
2015-05-04	Name : The remote Fedora host is missing a security update. File : fedora_2015-6951.nasl - Type : ACT_GATHER_INFO
2015-04-22	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2015-111-09.nasl - Type : ACT_GATHER_INFO
2015-04-20	Name : The remote AIX host has a version of OpenSSL installed that is affected by mu... File : aix_openssl_advisory13.nasl - Type : ACT_GATHER_INFO
2015-04-15	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0800.nasl - Type : ACT_GATHER_INFO
2015-04-14	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0800.nasl - Type : ACT_GATHER_INFO
2015-04-14	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150413_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2015-04-14	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0800.nasl - Type : ACT_GATHER_INFO
2015-04-06	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL16317.nasl - Type : ACT_GATHER_INFO
2015-04-01	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0752.nasl - Type : ACT_GATHER_INFO
2015-03-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-063.nasl - Type : ACT_GATHER_INFO
2015-03-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-062.nasl - Type : ACT_GATHER_INFO
2015-03-26	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150324_openssl_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2015-03-26	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150324_openssl_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2015-03-26	Name : The remote Debian host is missing a security update. File : debian_DLA-177.nasl - Type : ACT_GATHER_INFO
2015-03-25	Name : The remote Fedora host is missing a security update. File : fedora_2015-4320.nasl - Type : ACT_GATHER_INFO
2015-03-25	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-498.nasl - Type : ACT_GATHER_INFO
2015-03-25	Name : The remote Fedora host is missing a security update. File : fedora_2015-4300.nasl - Type : ACT_GATHER_INFO
2015-03-25	Name : The remote Fedora host is missing a security update. File : fedora_2015-4303.nasl - Type : ACT_GATHER_INFO
2015-03-25	Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2015-0039.nasl - Type : ACT_GATHER_INFO
2015-03-25	Name : The remote Windows host contains a program that is affected by multiple vulne... File : stunnel_5_12.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0715.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0715.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0716.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201503-11.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote service is affected by multiple vulnerabilities. File : openssl_0_9_8zf.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_0r.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_1m.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_2a.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0715.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0716.nasl - Type : ACT_GATHER_INFO
2015-03-24	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0716.nasl - Type : ACT_GATHER_INFO
2015-03-23	Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-247.nasl - Type : ACT_GATHER_INFO
2015-03-23	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libopenssl-devel-150317.nasl - Type : ACT_GATHER_INFO
2015-03-20	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2537-1.nasl - Type : ACT_GATHER_INFO
2015-03-20	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_compat-openssl097g-150317.nasl - Type : ACT_GATHER_INFO
2015-03-20	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_9d15355bce7c11e49db0d050992ecde8.nasl - Type : ACT_GATHER_INFO
2015-03-20	Name : The remote Debian host is missing a security-related update. File : debian_DSA-3197.nasl - Type : ACT_GATHER_INFO
2014-10-12	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-349.nasl - Type : ACT_GATHER_INFO
2014-06-06	Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_1h.nasl - Type : ACT_GATHER_INFO
2014-04-08	Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_0m.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2016-01-22 09:26:10	Multiple Updates
2015-03-25 00:24:43	Multiple Updates
2015-03-21 13:27:45	Multiple Updates
2015-03-20 21:31:31	Multiple Updates
2015-03-20 17:29:11	Multiple Updates
2015-03-20 05:29:41	Multiple Updates
2015-03-19 17:24:27	First insertion

Global Informations

Type	Count
CWE ID(s)	3
Oval ID(s)	12
CPE ID(s)	286
IAVM(s)	4
Snort® Rule(s)	1
Nessus® Exploit(s)	67

	Related
7.5	CVE-2015-0292
6.8	CVE-2015-0209
5	CVE-2015-0289
5	CVE-2015-0288
5	CVE-2015-0287
5	CVE-2015-0286
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 6 more Alert(s)

7.5 - DSA-3197

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

Information Assurance Vulnerability Management (IAVM)

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU