The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
Configuration 6 (hide)
AND |
|
Configuration 7 (hide)
|
Configuration 8 (hide)
AND |
|
Configuration 9 (hide)
AND |
|
Configuration 10 (hide)
|
Configuration 11 (hide)
|
Configuration 12 (hide)
|
Configuration 13 (hide)
|
Configuration 14 (hide)
|
Configuration 15 (hide)
|
Configuration 16 (hide)
AND |
|
Configuration 17 (hide)
|
Configuration 18 (hide)
|
History
No history.
Information
Published : 2014-04-07 22:55
Updated : 2025-04-12 10:46
NVD link : CVE-2014-0160
Mitre link : CVE-2014-0160
CVE.ORG link : CVE-2014-0160
JSON object : View
Products Affected
opensuse
- opensuse
siemens
- simatic_s7-1500t_firmware
- application_processing_engine
- application_processing_engine_firmware
- simatic_s7-1500t
- cp_1543-1_firmware
- simatic_s7-1500
- wincc_open_architecture
- cp_1543-1
- elan-8.2
- simatic_s7-1500_firmware
redhat
- enterprise_linux_workstation
- virtualization
- enterprise_linux_server_aus
- enterprise_linux_server_tus
- storage
- enterprise_linux_desktop
- enterprise_linux_server
- gluster_storage
- enterprise_linux_server_eus
ricon
- s9922l
- s9922l_firmware
filezilla-project
- filezilla_server
intellian
- v60_firmware
- v100_firmware
- v100
- v60
mitel
- mivoice
- micollab
fedoraproject
- fedora
canonical
- ubuntu_linux
broadcom
- symantec_messaging_gateway
debian
- debian_linux
openssl
- openssl
splunk
- splunk
CWE
CWE-125
Out-of-bounds Read