Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

None

Privileges Required

None

Attack Vector

Network

0

CVE-2015-3195

Disclosure Date: December 06, 2015 •

CVE-2015-3195 CVSS v3 Base Score: 5.3

Description

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

5.3 Medium

Impact Score:

1.4

Exploitability Score:

3.9

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector (AV):

Network

Attack Complexity (AC):

Low

Privileges Required (PR):

None

User Interaction (UI):

None

Scope (S):

Unchanged

Confidentiality (C):

None

Integrity (I):

None

Availability (A):

Low

Vendors

Products

References

Canonical

CVE-2015-3195 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3195)

BID-78626 (http://www.securityfocus.com/bid/78626)

BID-91787 (http://www.securityfocus.com/bid/91787)

Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

APPLE-SA-2016-03-21-5 (http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html)

http://rhn.redhat.com/errata/RHSA-2016-2056.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

https://support.apple.com/HT206167

20151204 Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products (http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl)

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017

http://lists.opensuse.org/opensuse-updates/2015-12/msg00070.html

http://rhn.redhat.com/errata/RHSA-2015-2617.html

http://www.fortiguard.com/advisory/openssl-advisory-december-2015

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100

http://rhn.redhat.com/errata/RHSA-2015-2616.html

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761

HPSBGN03536 (http://marc.info?l=bugtraq&m=145382583417444&w=2)

USN-2830-1 (http://www.ubuntu.com/usn/USN-2830-1)

http://lists.opensuse.org/opensuse-updates/2015-12/msg00071.html

FEDORA-2015-d87d60b9a9 (http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.html)

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

http://rhn.redhat.com/errata/RHSA-2016-2957.html

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

http://openssl.org/news/secadv/20151203.txt

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

SECTRACK-1034294 (http://www.securitytracker.com/id/1034294)

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733

https://git.openssl.org?p=openssl.git;a=commit;h=cc598f321fbac9c04da5766243ed55d55948637d

http://fortiguard.com/advisory/openssl-advisory-december-2015

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322

DSA-3413 (http://www.debian.org/security/2015/dsa-3413)

http://lists.opensuse.org/opensuse-updates/2015-12/msg00087.html

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

http://lists.opensuse.org/opensuse-updates/2015-12/msg00103.html

Miscellaneous

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583

Rapid7

Technical Analysis