CVE-2015-3195

Published: Dec 6, 2015Modified: May 6, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

Affected (56)

Products: Apple: Mac Os X · Oracle: Api Gateway, Communications Webrtc Session Controller, Exalogic Infrastructure, Http Server, Integrated Lights Out Manager Firmware, Life Sciences Data Hub, Linux, Solaris, Sun Ray Software, Transportation Management, Vm Server, Vm Virtualbox · Openssl: Openssl · +6 more

Show all products

1 product

12 products

Communications Webrtc Session Controller

Exalogic Infrastructure

Http Server

Integrated Lights Out Manager Firmware

Life Sciences Data Hub

Linux

Solaris

Sun Ray Software

Transportation Management

1 product

5 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Enterprise Linux Workstation

1 product

1 product

2 products

1 product

Linux Enterprise Server

Fedoraproject

1 product

Fedora

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	version < 10.11.4

Configuration B

21 vulnerable

Vulnerable Software	Affected Versions
Oracle Api Gateway	Version 11.1.2.3.0
Oracle Api Gateway	Version 11.1.2.4.0
Oracle Communications Webrtc Session Controller	Version 7.0
Oracle Communications Webrtc Session Controller	Version 7.1
Oracle Communications Webrtc Session Controller	Version 7.2
Oracle Exalogic Infrastructure	Version 1.0
Oracle Exalogic Infrastructure	Version 2.0
Oracle Http Server	Version 11.5.10.2
Oracle Integrated Lights Out Manager Firmware	3.0 ≤ version ≤ 4.0.4
Oracle Life Sciences Data Hub	Version 2.1
Oracle Linux	Version 5
Oracle Linux	Version 6
Oracle Linux	Version 7
Oracle Solaris	Version 10
Oracle Solaris	Version 11.3
Oracle Sun Ray Software	Version 11.1
Oracle Transportation Management	Version 6.1
Oracle Transportation Management	Version 6.2
Oracle Vm Server	Version 3.2
Oracle Vm Virtualbox	version < 4.3.36
Oracle Vm Virtualbox	5.0.0 ≤ version < 5.0.14

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	version < 0.9.8zh
Openssl Openssl	1.0.0 ≤ version < 1.0.0t
Openssl Openssl	1.0.1 ≤ version < 1.0.1q
Openssl Openssl	1.0.2 ≤ version < 1.0.2e

Configuration D

18 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 5.0
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 5.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Aus	Version 7.3
Redhat Enterprise Linux Server Aus	Version 7.4
Redhat Enterprise Linux Server Aus	Version 7.6
Redhat Enterprise Linux Server Aus	Version 7.7
Redhat Enterprise Linux Server Tus	Version 7.2
Redhat Enterprise Linux Server Tus	Version 7.3
Redhat Enterprise Linux Server Tus	Version 7.6
Redhat Enterprise Linux Server Tus	Version 7.7
Redhat Enterprise Linux Workstation	Version 5.0
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration E

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.04
Canonical Ubuntu Linux	Version 15.10

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration G

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1
Opensuse Opensuse	Version 11.4
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2
Suse Linux Enterprise Server	Version 10 sp4

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 22

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (94)

http://fortiguard.com/advisory/openssl-advisory-december-2015

Source: secalert@redhat.com

Broken Link

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733

Source: secalert@redhat.com

Third Party Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

Third Party Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761

Source: secalert@redhat.com

Third Party Advisory

http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-12/msg00070.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-12/msg00071.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-12/msg00087.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-12/msg00103.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=145382583417444&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://openssl.org/news/secadv/20151203.txt

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2015-2616.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-2617.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2056.html

Source: secalert@redhat.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

Third Party Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2015/dsa-3413

Source: secalert@redhat.com

Third Party Advisory

http://www.fortiguard.com/advisory/openssl-advisory-december-2015

Source: secalert@redhat.com

Broken Link

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/78626

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1034294

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2830-1

Source: secalert@redhat.com

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=cc598f321fbac9c04da5766243ed55d55948637d

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322

Source: secalert@redhat.com

Third Party Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/HT206167

Source: secalert@redhat.com

Third Party Advisory

http://fortiguard.com/advisory/openssl-advisory-december-2015