What’s Vulnerable › Vulnerabilities

CVE-2015-3195

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 38.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-12-06 · updated 2026-06-17
• Weakness: CWE-200

Description

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

Affected products

• macOS: before 10.11.4 — fixed in 10.11.4
• Canonical Ubuntu Linux: 12.04, 14.04, 15.04, 15.10
• Debian Linux: 7.0, 8.0
• Fedoraproject Fedora: 22
• OpenSSL: before 0.9.8zh; from 1.0.0 before 1.0.0t; from 1.0.1 before 1.0.1q; from 1.0.2 before 1.0.2e — fixed in 0.9.8zh, 1.0.0t, 1.0.1q, 1.0.2e
• openSUSE Leap: 42.1
• Opensuse: 11.4, 13.1, 13.2
• Oracle Corporation API Gateway: 11.1.2.3.0, 11.1.2.4.0
• Oracle Corporation Communications WebRTC Session Controller: 7.0, 7.1, 7.2
• Oracle Exalogic Infrastructure: 1.0, 2.0
• Oracle Corporation Oracle HTTP Server: 11.5.10.2
• Oracle Corporation SSM - (hot-tamale) ILOM: Integrated Lights Out Manager: from 3.0 through 4.0.4
• Oracle Life Sciences Data Hub: 2.1
• Oracle Corporation Oracle Linux: 5, 6, 7
• Oracle Corporation Solaris Operating System: 10, 11.3
• Oracle Sun Ray Software: 11.1
• Oracle Corporation Transportation Management: 6.1, 6.2
• Oracle Vm Server: 3.2
• Oracle Corporation VM VirtualBox: before 4.3.36; from 5.0.0 before 5.0.14 — fixed in 4.3.36, 5.0.14
• RedHat Enterprise Linux Desktop: 5.0, 6.0, 7.0
• RedHat Enterprise Linux Server: 5.0, 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.2, 7.3, 7.4, 7.6, 7.7
• RedHat Enterprise Linux Server Tus: 7.2, 7.3, 7.6, 7.7
• RedHat Enterprise Linux Workstation: 5.0, 6.0, 7.0
• SUSE Linux Enterprise Server: 10-sp4

How to fix

Upgrade to a fixed version: macOS 10.11.4; OpenSSL 0.9.8zh, 1.0.0t, 1.0.1q, 1.0.2e; Oracle Corporation VM VirtualBox 4.3.36, 5.0.14. Check the vendor advisory for mitigations.

References

• http://fortiguard.com/advisory/openssl-advisory-december-2015
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html
• http://lists.opensuse.org/opensuse-updates/2015-12/msg00070.html
• http://lists.opensuse.org/opensuse-updates/2015-12/msg00071.html
• http://lists.opensuse.org/opensuse-updates/2015-12/msg00087.html

Get alerted when CVE-2015-3195 or the next vulnerability affects your stack