NetSight
IP …
medium4.3

CVE-2015-3196

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint…

Impact

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.

Affected products

VendorProductAffected versions
HpIcewall Sso
Version 10.0
HpIcewall Sso Agent Option
Version 10.0
OpensslOpenssl
Versions 1.0.0, 1.0.0a, 1.0.0b, 1.0.0c, 1.0.0d, 1.0.0e
OracleVm Virtualbox
from 4.3.0 through 4.3.35
from 5.0.0 through 5.0.13
FedoraprojectFedora
Version 22
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4
RedhatEnterprise Linux Server Eus
Versions 6.7, 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux Server Tus
Versions 7.2, 7.3, 7.6
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04, 15.10

Weakness classification

CWE-362

References