NVD

Id
25095  
Name
CVE-2015-3196  
Description
ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2015-12-06  
Modified Date
2016-12-30  
Seq
2015-3196  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
132586 25095 CVE-2015-3196 http://fortiguard.com/advisory/openssl-advisory-december-2015  View
132587 25095 CVE-2015-3196 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759  View
132588 25095 CVE-2015-3196 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761  View
132589 25095 CVE-2015-3196 FEDORA-2015-d87d60b9a9  View
132590 25095 CVE-2015-3196 openSUSE-SU-2015:2288  View
132591 25095 CVE-2015-3196 openSUSE-SU-2015:2289  View
132592 25095 CVE-2015-3196 HPSBGN03536  View
132593 25095 CVE-2015-3196 http://openssl.org/news/secadv/20151203.txt  View
132594 25095 CVE-2015-3196 RHSA-2015:2617  View
132595 25095 CVE-2015-3196 20151204 Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products  View
132596 25095 CVE-2015-3196 DSA-3413  View
132597 25095 CVE-2015-3196 http://www.fortiguard.com/advisory/openssl-advisory-december-2015  View
132598 25095 CVE-2015-3196 http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html  View
132599 25095 CVE-2015-3196 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html  View
132600 25095 CVE-2015-3196 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html  View
132601 25095 CVE-2015-3196 78622  View
132602 25095 CVE-2015-3196 SSA:2015-349-04  View
132603 25095 CVE-2015-3196 USN-2830-1  View
132604 25095 CVE-2015-3196 https://git.openssl.org/?p=openssl.git;a=commit;h=3c66a669dfc7b3792f7af0758ea26fe8502ce70c  View
132605 25095 CVE-2015-3196 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173  View
132606 25095 CVE-2015-3196 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
10797 JVNDB-2015-006117 OpenSSL の ssl/s3_clnt.c におけるサービス運用妨害 (DoS) の脆弱性 OpenSSL の ssl/s3_clnt.c は、マルチスレッドクライアントに使用された場合、誤ったデータ構造に PSK identity hint を書き込むため、サービス運用妨害 (競合状態および二重解放) 状態にされる脆弱性が存在します。 CVE-2015-3196 80421 CVE-2015-3196 25095 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006117.html 2015-12-03 2016-05-31 View