CVE-2015-0290 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Openssl

CWE-17CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-20 — Improper Input ValidationCWE-310CWE-787 — Out-of-bounds Write22 documents7 sources
Severity
5.0MEDIUMNVD
EPSS
32.6%
top 3.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
OpensslCisco ProductsDebian Openssl
Timeline
PublishedMar 19
Latest updateDec 19

Description

The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non-blocking I/O cases, which allows remote attackers to cause a denial of service (pointer corruption and application crash) via unspecified vectors.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶NVDopenssl/openssl1.0.2

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-hhgx-2m78-2p9v: The multi-block feature in the ssl3_write_bytes function in s3_pkt↗2022-05-14
▶

📋Vendor Advisories

18
CISA ICS
Siemens SCALANCE X-200RNA Switch Devices↗2022-12-19
▶
CISA ICS
Rockwell Automation Stratix 5900↗2017-05-10
▶
Cisco
Multiple Vulnerabilities in OpenSSL (March 2015) Affecting Cisco Products↗2015-03-20
▶
Red Hat
openssl: multiblock corrupted pointer↗2015-03-19
▶
Debian
CVE-2015-0290: openssl - The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL ...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-0290 openssl: multiblock corrupted pointer↗2015-03-16
▶
Bugzilla
CVE-2014-8172 kernel: soft lockup on aio↗2015-03-04
▶
CVE-2015-0290 — Openssl vulnerability | cvebase