Skip to content
OpenAdvisories
Unscored USN-2459-1 7 CVEs

openssl vulnerabilities

Published Jan 12, 2015 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Pieter Wuille discovered that OpenSSL incorrectly handled Bignum squaring.
(CVE-2014-3570)

Markus Stenberg discovered that OpenSSL incorrectly handled certain crafted
DTLS messages. A remote attacker could use this issue to cause OpenSSL to
crash, resulting in a denial of service. (CVE-2014-3571)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled certain
handshakes. A remote attacker could possibly use this issue to downgrade to
ECDH, removing forward secrecy from the ciphersuite. (CVE-2014-3572)

Antti Karjalainen, Tuomo Untinen and Konrad Kraszewski discovered that
OpenSSL incorrectly handled certain certificate fingerprints. A remote
attacker could possibly use this issue to trick certain applications that
rely on the uniqueness of fingerprints. (CVE-2014-8275)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled certain
key exchanges. A remote attacker could possibly use this issue to downgrade
the security of the session to EXPORT_RSA. (CVE-2015-0204)

Karthikeyan Bhargavan discovered that OpenSSL incorrectly handled client
authentication. A remote attacker could possibly use this issue to
authenticate without the use of a private key in certain limited scenarios.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0205)

Chris Mueller discovered that OpenSSL incorrect handled memory when
processing DTLS records. A remote attacker could use this issue to cause
OpenSSL to consume resources, resulting in a denial of service. This issue
only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 14.10.
(CVE-2015-0206)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS openssl 1.0.1f-1ubuntu2.8

Vulnerabilities 7

  • Unscored —
    CVE-2014-3570 Public exploit EPSS 22%

    The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly cal…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3571 EPSS 22%

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of servi…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3572

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-8275 Public exploit EPSS 15%

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificat…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0204 Public exploit EPSS 99%

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0205 Public exploit EPSS 22%

    The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client au…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-0206 EPSS 57%

    Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allo…

    openssl openssl Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-3570
  • report
    https://ubuntu.com/security/CVE-2014-3571
  • report
    https://ubuntu.com/security/CVE-2014-3572
  • report
    https://ubuntu.com/security/CVE-2014-8275
  • report
    https://ubuntu.com/security/CVE-2015-0204
  • report
    https://ubuntu.com/security/CVE-2015-0205
  • report
    https://ubuntu.com/security/CVE-2015-0206