The version of OpenSSL installed on the remote host is prior to 1.0.1m. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1m advisory.

  - An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2     implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before     1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for     remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a     related issue to CVE-2016-0800. (CVE-2016-0704)

  - The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf,     1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY     CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the     MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a     related issue to CVE-2016-0800. (CVE-2016-0703)

  - The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2     before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon     exit) via a crafted CLIENT-MASTER-KEY message. (CVE-2015-0293)

  - The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2     before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a     denial of service (NULL pointer dereference and application crash) by leveraging an application that     processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to     crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c. (CVE-2015-0289)

  - The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r,     1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which     might allow attackers to cause a denial of service (invalid write operation and memory corruption) by     leveraging an application that relies on ASN.1 structure reuse. (CVE-2015-0287)

  - The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1     before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows     remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted     X.509 certificate to an endpoint that uses the certificate-verification feature. (CVE-2015-0286)

  - Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before     0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to     cause a denial of service (memory corruption and application crash) or possibly have unspecified other     impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.
    (CVE-2015-0209)

  - The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r,     1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL     pointer dereference and application crash) via an invalid certificate key. (CVE-2015-0288)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

OpenSSL was updated to fix various security issues.

Following security issues were fixed :

  - CVE-2015-0209: A Use After Free following     d2i_ECPrivatekey error was fixed which could lead to     crashes for attacker supplied Elliptic Curve keys. This     could be exploited over SSL connections with client     supplied keys.

  - CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was     fixed that could be exploited by attackers when e.g.
    client authentication is used. This could be exploited     over SSL connections.

  - CVE-2015-0287: A ASN.1 structure reuse memory corruption     was fixed. This problem can not be exploited over     regular SSL connections, only if specific client     programs use specific ASN.1 routines.

  - CVE-2015-0288: A X509_to_X509_REQ NULL pointer     dereference was fixed, which could lead to crashes. This     function is not commonly used, and not reachable over     SSL methods.

  - CVE-2015-0289: Several PKCS7 NULL pointer dereferences     were fixed, which could lead to crashes of programs     using the PKCS7 APIs. The SSL apis do not use those by     default.

  - CVE-2015-0292: Various issues in base64 decoding were     fixed, which could lead to crashes with memory     corruption, for instance by using attacker supplied PEM     data.

  - CVE-2015-0293: Denial of service via reachable assert in     SSLv2 servers, could be used by remote attackers to     terminate the server process. Note that this requires     SSLv2 being allowed, which is not the default.

  - CVE-2009-5146: A memory leak in the TLS hostname     extension was fixed, which could be used by remote     attackers to run SSL services out of memory.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openssl packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.

An invalid pointer use flaw was found in OpenSSL's ASN1_TYPE_cmp() function. A remote attacker could crash a TLS/SSL client or server using OpenSSL via a specially crafted X.509 certificate when the attacker-supplied certificate was verified by the application.
(CVE-2015-0286)

An integer underflow flaw, leading to a buffer overflow, was found in the way OpenSSL decoded malformed Base64-encoded inputs. An attacker able to make an application using OpenSSL decode a specially crafted Base64-encoded input (such as a PEM file) could use this flaw to cause the application to crash. Note: this flaw is not exploitable via the TLS/SSL protocol because the data being transferred is not Base64-encoded. (CVE-2015-0292)

A denial of service flaw was found in the way OpenSSL handled SSLv2 handshake messages. A remote attacker could use this flaw to cause a TLS/SSL server using OpenSSL to exit on a failed assertion if it had both the SSLv2 protocol and EXPORT-grade cipher suites enabled.
(CVE-2015-0293)

A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported. (CVE-2015-0209)

An out-of-bounds write flaw was found in the way OpenSSL reused certain ASN.1 structures. A remote attacker could possibly use a specially crafted ASN.1 structure that, when parsed by an application, would cause that application to crash. (CVE-2015-0287)

A NULL pointer dereference flaw was found in OpenSSL's X.509 certificate handling implementation. A specially crafted X.509 certificate could cause an application using OpenSSL to crash if the application attempted to convert the certificate to a certificate request. (CVE-2015-0288)

A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS#7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected by this flaw. (CVE-2015-0289)

Red Hat would like to thank the OpenSSL project for reporting CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293. Upstream acknowledges Stephen Henson of the OpenSSL development team as the original reporter of CVE-2015-0286, Emilia Käsper of the OpenSSL development team as the original reporter of CVE-2015-0287, Brian Carpenter as the original reporter of CVE-2015-0288, Michal Zalewski of Google as the original reporter of CVE-2015-0289, Robert Dugal and David Ramos as the original reporters of CVE-2015-0292, and Sean Burford of Google and Emilia Käsper of the OpenSSL development team as the original reporters of CVE-2015-0293.

This update also fixes the following bug :

* When a wrapped Advanced Encryption Standard (AES) key did not require any padding, it was incorrectly padded with 8 bytes, which could lead to data corruption and interoperability problems. With this update, the rounding algorithm in the RFC 5649 key wrapping implementation has been fixed. As a result, the wrapped key conforms to the specification, which prevents the described problems.
(BZ#1197667)

All openssl users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

The version of OpenSSL installed on the remote host is prior to 1.0.0r. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.0r advisory.

  - An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2     implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before     1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for     remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a     related issue to CVE-2016-0800. (CVE-2016-0704)

  - The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf,     1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY     CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the     MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a     related issue to CVE-2016-0800. (CVE-2016-0703)

  - The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2     before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon     exit) via a crafted CLIENT-MASTER-KEY message. (CVE-2015-0293)

  - The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2     before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a     denial of service (NULL pointer dereference and application crash) by leveraging an application that     processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to     crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c. (CVE-2015-0289)

  - The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r,     1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which     might allow attackers to cause a denial of service (invalid write operation and memory corruption) by     leveraging an application that relies on ASN.1 structure reuse. (CVE-2015-0287)

  - The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1     before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows     remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted     X.509 certificate to an endpoint that uses the certificate-verification feature. (CVE-2015-0286)

  - Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before     0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to     cause a denial of service (memory corruption and application crash) or possibly have unspecified other     impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.
    (CVE-2015-0209)

  - The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r,     1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL     pointer dereference and application crash) via an invalid certificate key. (CVE-2015-0288)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

libressl was updated to version 2.2.1 to fix 16 security issues.

LibreSSL is a fork of OpenSSL. Because of that CVEs affecting OpenSSL often also affect LibreSSL.

These security issues were fixed :

  - CVE-2014-3570: The BN_sqr implementation in OpenSSL     before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before     1.0.1k did not properly calculate the square of a BIGNUM     value, which might make it easier for remote attackers     to defeat cryptographic protection mechanisms via     unspecified vectors, related to crypto/bn/asm/mips.pl,     crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c     (bsc#912296).

  - CVE-2014-3572: The ssl3_get_key_exchange function in     s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before     1.0.0p, and 1.0.1 before 1.0.1k allowed remote SSL     servers to conduct ECDHE-to-ECDH downgrade attacks and     trigger a loss of forward secrecy by omitting the     ServerKeyExchange message (bsc#912015).

  - CVE-2015-1792: The do_free_upto function in     crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0     before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before     1.0.2b allowed remote attackers to cause a denial of     service (infinite loop) via vectors that trigger a NULL     value of a BIO data structure, as demonstrated by an     unrecognized X.660 OID for a hash function (bsc#934493).

  - CVE-2014-8275: OpenSSL before 0.9.8zd, 1.0.0 before     1.0.0p, and 1.0.1 before 1.0.1k did not enforce certain     constraints on certificate data, which allowed remote     attackers to defeat a fingerprint-based     certificate-blacklist protection mechanism by including     crafted data within a certificate's unsigned portion,     related to crypto/asn1/a_verify.c,     crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and     crypto/x509/x_all.c (bsc#912018).

  - CVE-2015-0209: Use-after-free vulnerability in the     d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in     OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1     before 1.0.1m, and 1.0.2 before 1.0.2a might allowed     remote attackers to cause a denial of service (memory     corruption and application crash) or possibly have     unspecified other impact via a malformed Elliptic Curve     (EC) private-key file that is improperly handled during     import (bsc#919648).

  - CVE-2015-1789: The X509_cmp_time function in     crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0     before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before     1.0.2b allowed remote attackers to cause a denial of     service (out-of-bounds read and application crash) via a     crafted length field in ASN1_TIME data, as demonstrated     by an attack against a server that supports client     authentication with a custom verification callback     (bsc#934489).

  - CVE-2015-1788: The BN_GF2m_mod_inv function in     crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0     before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before     1.0.2b did not properly handle ECParameters structures     in which the curve is over a malformed binary polynomial     field, which allowed remote attackers to cause a denial     of service (infinite loop) via a session that used an     Elliptic Curve algorithm, as demonstrated by an attack     against a server that supports client authentication     (bsc#934487).

  - CVE-2015-1790: The PKCS7_dataDecodefunction in     crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0     before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before     1.0.2b allowed remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a PKCS#7 blob that used ASN.1 encoding and lacks     inner EncryptedContent data (bsc#934491).

  - CVE-2015-0287: The ASN1_item_ex_d2i function in     crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0     before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before     1.0.2a did not reinitialize CHOICE and ADB data     structures, which might allowed attackers to cause a     denial of service (invalid write operation and memory     corruption) by leveraging an application that relies on     ASN.1 structure reuse (bsc#922499).

  - CVE-2015-0286: The ASN1_TYPE_cmp function in     crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0     before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before     1.0.2a did not properly perform boolean-type     comparisons, which allowed remote attackers to cause a     denial of service (invalid read operation and     application crash) via a crafted X.509 certificate to an     endpoint that used the certificate-verification feature     (bsc#922496).

  - CVE-2015-0289: The PKCS#7 implementation in OpenSSL     before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before     1.0.1m, and 1.0.2 before 1.0.2a did not properly handle     a lack of outer ContentInfo, which allowed attackers to     cause a denial of service (NULL pointer dereference and     application crash) by leveraging an application that     processes arbitrary PKCS#7 data and providing malformed     data with ASN.1 encoding, related to     crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c     (bsc#922500).

  - CVE-2015-0288: The X509_to_X509_REQ function in     crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0     before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before     1.0.2a might allowed attackers to cause a denial of     service (NULL pointer dereference and application crash)     via an invalid certificate key (bsc#920236).

  - CVE-2014-8176: The dtls1_clear_queues function in     ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before     1.0.0m, and 1.0.1 before 1.0.1h frees data structures     without considering that application data can arrive     between a ChangeCipherSpec message and a Finished     message, which allowed remote DTLS peers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unexpected application data (bsc#934494).

  - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a     DHE_EXPORT ciphersuite is enabled on a server but not on     a client, did not properly convey a DHE_EXPORT choice,     which allowed man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with     DHE replaced by DHE_EXPORT and then rewriting a     ServerHello with DHE_EXPORT replaced by DHE, aka the     'Logjam' issue (bsc#931600).

  - CVE-2015-0205: The ssl3_get_cert_verify function in     s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1     before 1.0.1k accepts client authentication with a     Diffie-Hellman (DH) certificate without requiring a     CertificateVerify message, which allowed remote     attackers to obtain access without knowledge of a     private key via crafted TLS Handshake Protocol traffic     to a server that recognizes a Certification Authority     with DH support (bsc#912293).

  - CVE-2015-0206: Memory leak in the dtls1_buffer_record     function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and     1.0.1 before 1.0.1k allowed remote attackers to cause a     denial of service (memory consumption) by sending many     duplicate records for the next epoch, leading to failure     of replay detection (bsc#912292).

Multiple vulnerabilities has been discovered and corrected in openssl :

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment (CVE-2010-5298).

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack (CVE-2014-0076).

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug (CVE-2014-0160).

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment (CVE-2014-0195).

The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition (CVE-2014-0198).

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake (CVE-2014-0221).

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the CCS Injection vulnerability (CVE-2014-0224).

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value (CVE-2014-3470).

Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message (CVE-2014-3513).

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the POODLE issue (CVE-2014-3566).

Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure (CVE-2014-3567).

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix (CVE-2014-3569).

The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c (CVE-2014-3570).

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c (CVE-2014-3571).

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message (CVE-2014-3572).

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c (CVE-2014-8275).

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the FREAK issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations (CVE-2015-0204).

The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support (CVE-2015-0205).

Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection (CVE-2015-0206).

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import (CVE-2015-0209).

The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature (CVE-2015-0286).

The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse (CVE-2015-0287).

The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key (CVE-2015-0288).

The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c (CVE-2015-0289).

The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message (CVE-2015-0293).

The updated packages have been upgraded to the 1.0.1m version where these security flaws has been fixed.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.4. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - afpserver
  - apache
  - AppleFSCompression
  - AppleGraphicsControl
  - AppleThunderboltEDMService
  - ATS
  - Bluetooth
  - Certificate Trust Policy
  - CFNetwork HTTPAuthentication
  - CoreText
  - coreTLS
  - DiskImages
  - Display Drivers
  - EFI
  - FontParser
  - Graphics Driver
  - ImageIO
  - Install Framework Legacy
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOFireWireFamily
  - Kernel
  - kext tools
  - Mail
  - ntfs
  - ntp
  - OpenSSL
  - QuickTime
  - Security
  - Spotlight
  - SQLite
  - System Stats
  - TrueTypeScaler
  - zip

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is 10.6.8 or later but prior to 10.11 and is affected by multiple vulnerabilities in the following components : 

 - Address Book 
 - AirScan 
 - apache_mod_php 
 - Apple Online Store Kit 
 - AppleEvents 
 - Audio 
 - bash 
 - Certificate Trust Policy 
 - CFNetwork Cookies - CFNetwork FTPProtocol 
 - CFNetwork HTTPProtocol 
 - CFNetwork Proxies 
 - CFNetwork SSL 
 - CoreCrypto 
 - CoreText 
 - Dev Tools 
 - Disk Images 
 - dyld 
 - EFI 
 - Finder 
 - Game Center 
 - Heimdal 
 - ICU 
 - Install Framework Legacy 
 - Intel Graphics Driver 
 - IOAudioFamily 
 - IOGraphics 
 - IOHIDFamily 
 - IOStorageFamily 
 - Kernel 
 - libc 
 - libpthread 
 - libxpc 
 - Login Window 
 - lukemftpd 
 - Mail 
 - Multipeer Connectivity 
 - NetworkExtension 
 - Notes 
 - OpenSSH 
 - OpenSSL 
 - procmail 
 - remote_cmds 
 - removefile 
 - Ruby 
 - Safari 
 - Safari Downloads 
 - Safari Extensions 
 - Safari Safe Browsing 
 - Security 
 - SMB 
 - SQLite 
 - Telephony 
 - Terminal 
 - tidy 
 - Time Machine 
 - WebKit 
 - WebKit CSS 
 - WebKit JavaScript Bindings 
 - WebKit Page Loading 
 - WebKit Plug-ins

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.4 and the following components contain vulnerabilities :

  - Admin Framework 
-  afpserver 
 - apache 
 - AppleFSCompression 
 - AppleGraphicsControl 
 - AppleThunderboltEDMService 
 - ATS 
 - Bluetooth 
 - Certificate Trust Policy 
 - CFNetwork HTTPAuthentication 
 - CoreText 
 - coreTLS 
 - DiskImages 
 - Display Drivers 
 - EFI 
 - FontParser 
 - Graphics Driver 
 - ImageIO 
 - Install Framework Legacy 
 - Intel Graphics Driver 
 - IOAcceleratorFamily 
 - IOFireWireFamily 
 - Kernel 
 - kext tools 
 - Mail 
 - ntfs 
 - ntp 
 - OpenSSL 
 - QuickTime 
 - Security 
 - Spotlight 
 - SQLite 
 - System Stats 
 - TrueTypeScaler 
 - zip

OpenSSL before 0.9.8zf, 1.0.0r, or 1.0.1m are unpatched for the following vulnerabilities :

  - An invalid read flaw exists in the 'ASN1_TYPE_cmp()' function due to improperly performed boolean-type comparisons. A remote attacker can exploit this, via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature, to cause an invalid read operation, resulting in a denial of service. (CVE-2015-0286)

  - A flaw exists in the 'ASN1_item_ex_d2i()' function due to a failure to reinitialize 'CHOICE' and 'ADB' data structures when reusing a structure in ASN.1 parsing. This allows a remote attacker to cause an invalid write operation and memory corruption, resulting in a denial of service. (CVE-2015-0287)

  - A NULL pointer dereference flaw exists in the PKCS#7 parsing code due to incorrect handling of missing outer 'ContentInfo'. This allows a remote attacker, using an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, to cause a denial of service. (CVE-2015-0289)

  - A flaw exists in servers that both support SSLv2 and enable export cipher suites due to improper implementation of SSLv2. A remote attacker can exploit this, via a crafted CLIENT-MASTER-KEY message, to cause a denial of service. (CVE-2015-0293)

  - A NULL pointer dereference flaw exists in the 'X509_to_X509_REQ()' function due to improper processing of certificate keys. This allows a remote attacker, via a crafted X.509 certificate, to cause a denial of service. (CVE-2015-0288)

  - A use-after-free condition exists in the 'd2i_ECPrivateKey() function due to improper processing of malformed EC private key files during import. A remote attacker can exploit this to dereference or free already freed memory, resulting in a denial of service or other unspecified impact. (CVE-2015-0209)

The remote host is running a version of iOS that is prior to version 9.0 and the following components contain vulnerabilities :

 - Apple Pay 
 - AppleKeyStore 
 - Application Store 
 - Audio 
 - Certificate Trust Policy 
 - CFNetwork 
 - CFNetwork Cookies 
 - CFNetwork FTPProtocol 
 - CFNetwork Proxies 
 - CFNetwork SSL 
 - CoreAnimation 
 - CoreCrypto 
 - CoreText 
 - Data Detectors Engine 
 - Dev Tools 
 - Disk Images 
 - dyld 
 - Game Center 
 - ICU 
 - IOAcceleratorFamily 
 - IOHIDFamily 
 - IOKit 
 - IOMobileFrameBuffer 
 - IOStorageFamily 
 - iTunes Store 
 - JavaScriptCore 
 - Kernel 
 - libc 
 - libpthread 
 - Mail 
 - Multipeer Connectivity 
 - NetworkExtension 
 - OpenSSL 
 - PluginKit 
 - removefile 
 - Safari 
 - Safari Safe Browsing 
 - Security 
 - Siri 
 - SpringBoard 
 - SQLite 
 - tidy 
 - WebKit 
 - WebKit Canvas 
 - WebKit Page Loading

OpenSSL 1.0.2 prior to 1.0.2a are unpatched for the following vulnerabilities:

  - A flaw exists in the 'DTLSv1_listen()' function due to the state being preserved in the SSL object from one invocation to the next. A remote attacker can exploit this, via crafted DTLS traffic, to cause a segmentation fault, resulting in a denial of service. (CVE-2015-0207)

  - A flaw exists in the 'rsa_item_verify()' function due to improper implementation of ASN.1 signature verification. A remote attacker can exploit this, via an ASN.1 signature using the RSA PSS algorithm and invalid parameters, to cause a NULL pointer dereference, resulting in a denial of service. (CVE-2015-0208)

  - A use-after-free condition exists in the 'd2i_ECPrivateKey() function due to improper processing of malformed EC private key files during import. A remote attacker can exploit this to dereference or free already freed memory, resulting in a denial of service or other unspecified impact. (CVE-2015-0209)

  - A flaw exists in the 'ssl3_client_hello()' function due to improper validation of a PRNG seed before proceeding with a handshake, resulting in insufficient entropy and predictable output. This allows a man-in-the-middle attacker to defeat cryptographic protection mechanisms via a brute-force attack, resulting in the disclosure of sensitive information. (CVE-2015-0285)

  - An invalid read flaw exists in the 'ASN1_TYPE_cmp()' function due to improperly performed boolean-type comparisons. A remote attacker can exploit this, via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature, to cause an invalid read operation, resulting in a denial of service. (CVE-2015-0286)

  - A flaw exists in the 'ASN1_item_ex_d2i()' function due to a failure to reinitialize 'CHOICE' and 'ADB' data structures when reusing a structure in ASN.1 parsing. This allows a remote attacker to cause an invalid write operation and memory corruption, resulting in a denial of service. (CVE-2015-0287)

  - A NULL pointer dereference flaw exists in the 'X509_to_X509_REQ()' function due to improper processing of certificate keys. This allows a remote attacker, via a crafted X.509 certificate, to cause a denial of service. (CVE-2015-0288)

  - A NULL pointer dereference flaw exists in the PKCS#7 parsing code due to incorrect handling of missing outer 'ContentInfo'. This allows a remote attacker, using an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, to cause a denial of service. (CVE-2015-0289)

  - A flaw exists with the 'multiblock' feature in the 'ssl3_write_bytes()' function due to improper handling of certain non-blocking I/O cases. This allows a remote attacker to cause failed connections or a segmentation fault, resulting in a denial of service. (CVE-2015-0290)

  - A NULL pointer dereference flaw exists when handling clients attempting to renegotiate using an invalid signature algorithm extension. A remote attacker can exploit this to cause a denial of service. (CVE-2015-0291)

  - A flaw exists in servers that both support SSLv2 and enable export cipher suites due to improper implementation of SSLv2. A remote attacker can exploit this, via a crafted CLIENT-MASTER-KEY message, to cause a denial of service. (CVE-2015-0293)

  - A flaw exists in the 'ssl3_get_client_key_exchange()' function when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled. This allows a remote attacker, via a ClientKeyExchange message with a length of zero, to cause a denial of service. (CVE-2015-1787)

The remote host is running a version of OpenSSL which is potentially affected by the following vulnerabilities : 

  - A use-after-free condition exists in the d2i_ECPrivateKey() function due to improper processing of malformed EC private key files during import. A remote attacker can exploit this to dereference or free already freed memory, resulting in a denial of service or other unspecified impact. (CVE-2015-0209)

  - An invalid read flaw exists in the ASN1_TYPE_cmp() function due to improperly performed boolean-type comparisons. A remote attacker can exploit this, via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature, to cause an invalid read operation, resulting in a denial of service. (CVE-2015-0286)

  - A flaw exists in the ASN1_item_ex_d2i() function due to a failure to reinitialize 'CHOICE' and 'ADB' data structures when reusing a structure in ASN.1 parsing.  This allows a remote attacker to cause an invalid write operation and memory corruption, resulting in a denial of service. (CVE-2015-0287)

  - A NULL pointer dereference flaw exists in the PKCS#7 parsing code due to incorrect handling of missing outer ContentInfo. This allows a remote attacker, using an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, to cause a denial of service. (CVE-2015-0288)

  - The PKCS#7 implementation does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding. (CVE-2015-0289)

  - A flaw exists in servers that both support SSLv2 and enable export cipher suites due to improper implementation of SSLv2. A remote attacker can exploit this, via a crafted CLIENT-MASTER-KEY message, to cause a denial of service. (CVE-2015-0293)

ID	Name	Product	Family	Published	Updated	Severity
82032	OpenSSL 1.0.1 < 1.0.1m Multiple Vulnerabilities	Nessus	Web Servers	3/24/2015	10/23/2024	medium
119963	SUSE SLES12 Security Update : compat-openssl098 (SUSE-SU-2015:0553-1)	Nessus	SuSE Local Security Checks	1/2/2019	7/11/2024	high
81998	CentOS 7 : openssl (CESA-2015:0716)	Nessus	CentOS Local Security Checks	3/24/2015	1/4/2021	high
82031	OpenSSL 1.0.0 < 1.0.0r Multiple Vulnerabilities	Nessus	Web Servers	3/24/2015	10/23/2024	medium
84998	openSUSE Security Update : libressl (openSUSE-2015-507) (Logjam)	Nessus	SuSE Local Security Checks	7/27/2015	12/5/2022	high
82315	Mandriva Linux Security Advisory : openssl (MDVSA-2015:062)	Nessus	Mandriva Local Security Checks	3/30/2015	5/5/2022	high
84488	Mac OS X 10.10.x < 10.10.4 Multiple Vulnerabilities (GHOST) (Logjam)	Nessus	MacOS X Local Security Checks	7/1/2015	5/28/2024	critical
8982	Mac OS X < 10.11 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	10/28/2015	3/6/2019	critical
8801	Mac OS X < 10.10.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	10/12/2015	3/6/2019	critical
8662	OpenSSL 0.9.8 < 0.9.8zf / 1.0.0 < 1.0.0r / 1.0.1 < 1.0.1m Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	3/27/2015	3/6/2019	medium
8979	Apple iOS < 9.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	10/15/2015	3/6/2019	critical
8661	OpenSSL 1.0.2 < 1.0.2a Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	3/27/2015	3/6/2019	medium
801937	OpenSSL < 0.9.8zf / 1.0.0r / 1.0.1m / 1.0.2a Multiple Vulnerabilities	Log Correlation Engine	Web Servers	3/19/2015		medium

Detections

Analytics

Plugins Search

medium

high

high

medium

high

high

critical

critical

critical

medium

critical

medium

medium