High WID-SEC-2023-0498 9 CVEs

OpenSSL: Mehrere Schwachstellen

Published Aug 6, 2014 · Updated Feb 27, 2023 · Revision 65 · de-DE

Vendor: Debian Vendor: F5 Vendor: FreeBSD Vendor: HPE Vendor: IBM Vendor: NetBSD Vendor: Oracle Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: AIX Product: AIX 5.3 Product: AIX 6.1 Product: AIX 7.1 Product: ARX 6.0.0 - 6.4.0 Product: BIG-IP Access Policy Manager Product: BIG-IP Access Policy Manager 10.1.0 - 10.2.4 Product: BIG-IP Access Policy Manager 11.0.0 - 11.3.0 Product: BIG-IP Access Policy Manager 11.5.0 - 11.6.0 Product: BIG-IP Analytics 11.0.0 - 11.3.0 Product: BIG-IP Application Security Manager Product: BIG-IP Application Security Manager 10.0.0 - 10.2.4 Product: BIG-IP Application Security Manager 11.0.0 - 11.3.0 Product: BIG-IP Application Security Manager 11.5.0 - 11.6.0 Product: BIG-IP Edge Gateway Product: BIG-IP Edge Gateway 10.1.0 - 10.2.4 Product: BIG-IP Edge Gateway 11.0.0 - 11.3.0 Product: BIG-IP Global Traffic Manager 11.5.0 - 11.6.0 Product: BIG-IP Link Controller 11.5.0 - 11.6.0 Product: BIG-IP Local Traffic Manager +65 more

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen und eine Protokoll Downgrade Attacke durchzuführen.

Product

OpenSSL ist eine im Quelltext frei verfügbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.

Vulnerabilities 9

Unscored —

CVE-2014-3505 EPSS 46%

Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n,…

openssl openssl Debian Ubuntu

Aug 13, 2014
Unscored —

CVE-2014-3506 EPSS 46%

d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allo…

openssl openssl Debian Ubuntu

Aug 13, 2014
Unscored —

CVE-2014-3507 Public exploit EPSS 55%

Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 bef…

openssl openssl Debian Ubuntu

Aug 13, 2014
Unscored —

CVE-2014-3508 EPSS 25%

The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 be…

openssl openssl Debian Ubuntu

Aug 13, 2014
Unscored —

CVE-2014-3509 EPSS 13%

Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before…

openssl openssl Debian Ubuntu

Aug 13, 2014
Unscored —

CVE-2014-3510 EPSS 18%

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1…

openssl openssl Debian Ubuntu

Aug 13, 2014
Unscored —

CVE-2014-3511 EPSS 14%

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to …

openssl openssl Debian Ubuntu

Aug 13, 2014
Unscored —

CVE-2014-3512 EPSS 74%

Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote…

openssl openssl Debian Ubuntu

Aug 13, 2014
Unscored —

CVE-2014-5139 Public exploit EPSS 16%

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a de…

openssl openssl Debian Ubuntu

Aug 13, 2014

Revision history

2023-02-27 #65
Neue Updates von IBM aufgenommen
2022-04-10 #64
Neue Updates von Oracle Linux aufgenommen
2021-03-31 #63
Neue Updates von Oracle Linux aufgenommen
2019-08-18 #62
Neue Updates von Oracle Linux aufgenommen
2019-03-13 #61
Neue Updates von Oracle Linux aufgenommen
2016-01-24 #60
New remediations available
2015-03-24 #58
New remediations available
2015-03-24 #59
Version nicht vorhanden
2015-03-23 #57
New remediations available
2015-03-15 #56
New remediations available
2015-02-26 #53
New remediations available
2015-02-26 #54
Version nicht vorhanden
2015-02-26 #55
Version nicht vorhanden
2015-02-09 #51
New remediations available
2015-02-09 #52
Version nicht vorhanden
2015-02-04 #48
New remediations available
2015-02-04 #49
Version nicht vorhanden
2015-02-04 #50
Version nicht vorhanden
2015-01-14 #47
New remediations available
2014-12-28 #46
New remediations available
2014-09-17 #43
New remediations available
2014-09-17 #44
New remediations available
2014-09-17 #45
Version nicht vorhanden
2014-09-14 #41
New remediations available
2014-09-14 #42
Version nicht vorhanden

References

IBM Security Bulletin 690129 vom 2023-02-28
https://www.ibm.com/support/pages/node/690129
OpenSSL Security Advisory vom 2014-08-06
https://www.openssl.org/news/secadv_20140806.txt
Ubuntu Security Notice USN-2308-1 vom 2014-08-07
http://www.ubuntu.com/usn/usn-2308-1/
OpenVPN 2.3.4 Release Notes
http://openvpn.net/index.php/open-source/downloads.html
Red Hat Security Advisory RHSA-2014:1053-1 vom 2014-08-13
http://rhn.redhat.com/errata/RHSA-2014-1053.html
Red Hat Security Advisory RHSA-2014:1052-1 vom 2014-08-13
http://rhn.redhat.com/errata/RHSA-2014-1052.html
CentOS Errata and Security Advisory CESA-2014:1053 vom 2014-08-13
http://centos.distrosfaqs.org/centos-announce/cesa-20141053-moderate-centos-5-openssl-update/
CentOS Errata and Security Advisory CESA-2014:1052 vom 2014-08-13
http://centos.distrosfaqs.org/centos-announce/cesa-20141052-moderate-centos-6-openssl-update/
Red Hat Security Advisory RHSA-2014:1054-1 vom 2014-08-14
http://rhn.redhat.com/errata/RHSA-2014-1054.html
HP Security Bulletin HPSBUX03095 SSRT101674 rev.1 vom 2014-08-15
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c04404655
SUSE Security update for openssl1 (9599)
http://download.novell.com/patch/finder/?keywords=f511564183b6f13c2dc78cf5451408d0
SUSE Security update for OpenSSL (9598)
http://download.novell.com/patch/finder/?keywords=30032dcfaed48d7e5c0c3457c07419da
NetBSD Security Advisory 2014-008 vom 2014-08-27
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc
WinSCP Versionshistorie für 5.5.5 vom 2014-08-21
http://winscp.net/eng/docs/history#5.5.5
F5 Security Advisory SOL15573 vom 2014-09-05
http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15573.html?ref=rss
F5 Security Advisory SOL15568 vom 2014-09-05
http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15568.html?ref=rss
F5 Security Advisory SOL15564 vom 2014-09-05
http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15564.html?ref=rss
F5 Security Advisory SOL15571 vom 2014-09-05
http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15571.html?ref=rss
FreeBSD Security Advisory FreeBSD-SA-14:18.openssl vom 2014-09-09
http://security.freebsd.org/advisories/FreeBSD-SA-14:18.openssl.asc
HP SECURITY BULLETIN Document ID: c04426586
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04426586
RedHat Security Advisory RHSA-2014:1256-1
https://rhn.redhat.com/errata/RHSA-2014-1256.html
IBM Security Advisory vom 2014-09-09
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
SUSE Security update for OpenSSL (9662) vom 2014-09-09
https://download.suse.com/patch/finder/?keywords=d131eebfce5c601b41e006539b73bcb9
SUSE Security update for OpenSSL (8933) vom 2014-09-09
https://download.suse.com/patch/finder/?keywords=a13af464a610cda0eae18606907ad3af
SUSE Security update for OpenSSL (8935) vom 2014-09-09
https://download.suse.com/patch/finder/?keywords=9b67b5e9df54ba01bdf516a4768dfc90
SUSE Security update for OpenSSL (9663) vom 2014-09-09
https://download.suse.com/patch/finder/?keywords=99670be4c48bf7d4b638d26f459ded32
Oracle Third Party Vulnerability Resolution Blog
https://blogs.oracle.com/sunsecurity/entry/cve_2014_3505_denial_of
Gentoo Linux Security Advisory GLSA 201412-39 vom 2014-12-25
http://security.gentoo.org/glsa/glsa-201412-39.xml
sa85 vom 2015-01-14
https://kb.bluecoat.com/security-advisory/sa85
Red Hat Security Advisory RHSA-2015:0126-1 vom 2015-02-04
http://rhn.redhat.com/errata/RHSA-2015-0126.html
HP Security Bulletin Document ID: c04512909
https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04512909
HP Security Bulletin HPSBMU03260 rev.1
https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04571379
HP Security Bulletin Document ID: c04570627
https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04570627
SUSE Security Update SUSE-SU-2015:0578-1 vom 2015-03-23
https://www.suse.com/support/update/announcement/2015/suse-su-20150578-1.html
HP Security Bulletin HPSBMU03263
https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04574073
SUSE Security Update SUSE-SU-2014:1104-1 vom 2016-01-22
https://www.suse.com/support/update/announcement/2014/suse-su-20141104-1.html
Oracle Linux Security Advisory ELSA-2019-4581 vom 2019-03-13
http://linux.oracle.com/errata/ELSA-2019-4581.html
Oracle Linux Security Advisory ELSA-2019-4747 vom 2019-08-16
http://linux.oracle.com/errata/ELSA-2019-4747.html
Oracle Linux Security Advisory ELSA-2021-9150 vom 2021-04-01
https://linux.oracle.com/errata/ELSA-2021-9150.html
Oracle Linux Security Advisory ELSA-2022-9272 vom 2022-04-08
https://linux.oracle.com/errata/ELSA-2022-9272.html