NetSight
IP …
medium5.3

CVE-2015-3195

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mis…

Impact

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

Affected products

VendorProductAffected versions
AppleMac Os X
before 10.11.4
OracleApi Gateway
Versions 11.1.2.3.0, 11.1.2.4.0
OracleCommunications Webrtc Session Controller
Versions 7.0, 7.1, 7.2
OracleExalogic Infrastructure
Versions 1.0, 2.0
OracleHttp Server
Version 11.5.10.2
OracleLife Sciences Data Hub
Version 2.1
OracleSun Ray Software
Version 11.1
OracleTransportation Management
Versions 6.1, 6.2
OracleVm Server
Version 3.2
OracleVm Virtualbox
before 4.3.36
from 5.0.0 before 5.0.14
OracleIntegrated Lights Out Manager Firmware
from 3.0 through 4.0.4
OracleLinux
Versions 5, 6, 7

Weakness classification

CWE-200

References