Cloudanix VulnDB

CVE-2014-0160

High · 7.5 CISA KEV

CVSS

7.5

EPSS

100.0%

Published

Apr 7, 2014

CISA due date

May 25, 2022

The record

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 openssl 0 1.0.1g-1
Debian:12 openssl 0 1.0.1g-1
Debian:13 openssl 0 1.0.1g-1
Debian:14 openssl 0 1.0.1g-1
Debian:7 openssl 0 1.0.1e-2+deb7u5
Mageia:3 openssl 0 1.0.1e-1.5.mga3
Mageia:3 tor 0 0.2.4.22-1.mga3
Mageia:4 openssl 0 1.0.1e-8.2.mga4
Mageia:4 tor 0 0.2.4.22-1.mga4
Red Hat:enterprise_linux:6::client openssl 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::client openssl-debuginfo 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::client openssl-devel 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::client openssl-perl 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::client openssl-static 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::computenode openssl 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::computenode openssl-debuginfo 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::computenode openssl-devel 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::computenode openssl-perl 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::computenode openssl-static 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::hypervisor rhev-hypervisor6 0 0:6.5-20140407.0.el6ev
Red Hat:enterprise_linux:6::hypervisor rhev-hypervisor6 0 0:6.5-20140118.1.3.2.el6_5
Red Hat:enterprise_linux:6::server openssl 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::server openssl-debuginfo 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::server openssl-devel 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::server openssl-perl 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::server openssl-static 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::workstation openssl 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::workstation openssl-debuginfo 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::workstation openssl-devel 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::workstation openssl-perl 0 0:1.0.1e-16.el6_5.7
Red Hat:enterprise_linux:6::workstation openssl-static 0 0:1.0.1e-16.el6_5.7
Red Hat:rhev_manager:3 rhevm-spice-client 0 0:3.3-12.el6_5
Red Hat:rhev_manager:3 rhevm-spice-client-x64-cab 0 0:3.3-12.el6_5
Red Hat:rhev_manager:3 rhevm-spice-client-x64-msi 0 0:3.3-12.el6_5
Red Hat:rhev_manager:3 rhevm-spice-client-x86-cab 0 0:3.3-12.el6_5
Red Hat:rhev_manager:3 rhevm-spice-client-x86-msi 0 0:3.3-12.el6_5
Red Hat:storage:2.1:server:el6 openssl 0 0:1.0.1e-16.el6_5.7
Red Hat:storage:2.1:server:el6 openssl-debuginfo 0 0:1.0.1e-16.el6_5.7
Red Hat:storage:2.1:server:el6 openssl-devel 0 0:1.0.1e-16.el6_5.7
Red Hat:storage:2.1:server:el6 openssl-perl 0 0:1.0.1e-16.el6_5.7
Red Hat:storage:2.1:server:el6 openssl-static 0 0:1.0.1e-16.el6_5.7
openSUSE:Tumbleweed httrack 0 3.48.22-1.3
openSUSE:Tumbleweed openssl-1_1 0 1.1.1l-1.2
openSUSE:Tumbleweed stunnel 0 5.38-1.1
openSUSE:Tumbleweed tor 0 0.2.8.11-1.1

Related vulnerabilities