What’s Vulnerable › Vulnerabilities

CVE-2014-0160: OpenSSL Information Disclosure Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-05-04
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-04-07 · updated 2026-06-17
• Weakness: CWE-125

Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Affected products

• Symantec Messaging Gateway (SMG): 10.6.0, 10.6.1
• Canonical Ubuntu Linux: 12.04, 12.10, 13.10
• Debian Linux: 6.0, 7.0, 8.0
• Fedoraproject Fedora: 19, 20
• FileZilla Server: before 0.9.44 — fixed in 0.9.44
• Intellian V100 Firmware: 1.20, 1.21, 1.24
• Intellian V60 Firmware: 1.15, 1.25
• Mitel Micollab: 6.0, 7.0, 7.1, 7.2, 7.3, 7.3.0.104
• Mitel Mivoice: 1.1.2.5, 1.1.3.3, 1.2.0.11, 1.3.2.2, 1.4.0.102
• OpenSSL: from 1.0.1 before 1.0.1g — fixed in 1.0.1g
• Opensuse: 12.3, 13.1
• RedHat Enterprise Linux Desktop: 6.0
• RedHat Enterprise Linux Server: 6.0
• RedHat Enterprise Linux Server Aus: 6.5
• RedHat Enterprise Linux Server Eus: 6.5
• RedHat Enterprise Linux Server Tus: 6.5
• RedHat Enterprise Linux Workstation: 6.0
• Red Hat, Inc. Gluster Storage for RHEL 6: 2.1
• RedHat Storage: 2.1
• RedHat Virtualization: 6.0
• Ricon S9922L Firmware: 16.10.3(3794)
• Siemens Application Processing Engine Firmware: 2.0
• Siemens Cp 1543-1 Firmware: 1.1
• Siemens Elan-8.2: before 8.3.3 — fixed in 8.3.3
• Siemens SIMATIC S7-1500 CPU: 1.5
• Siemens Simatic S7-1500T Firmware: 1.5
• Siemens Wincc Open Architecture: 3.12
• Splunk Enterprise: from 6.0.0 before 6.0.3 — fixed in 6.0.3

How to fix

Upgrade to a fixed version: FileZilla Server 0.9.44; OpenSSL 1.0.1g; Siemens Elan-8.2 8.3.3; Splunk Enterprise 6.0.3. Check the vendor advisory for mitigations.

References

• http://advisories.mageia.org/MGASA-2014-0165.html
• http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/
• http://cogentdatahub.com/ReleaseNotes.html
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01
• http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=96db9023b881d7cd9f379b0c154650d6c108e9a3
• http://heartbleed.com/
• http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00005.html
• http://lists.opensuse.org/opensuse-updates/2014-04/msg00061.html

Get alerted when CVE-2014-0160 or the next vulnerability affects your stack