CVE-2015-3195 (CNNVD-201512-075)

MEDIUM
中文标题:
OpenSSL ASN1_TFLG_COMBINE 信息泄露漏洞
英文标题:
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 befo...
CVSS分数: 5.3
发布时间: 2015-12-06 00:00:00
漏洞类型: 信息泄露
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层（SSL v2/v3）和安全传输层（TLS v1）协议的通用加密库，它支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL的crypto/asn1/tasn_dec.c文件中的ASN1_TFLG_COMBINE实现过程中存在安全漏洞，该漏洞源于程序没有正确处理畸形的X509_ATTRIBUTE数据引发的错误。远程攻击者可通过在PKCS#7或CMS应用程序中触发解码失败利用该漏洞获取进程内存中的敏感信息。以下版本受到影响：OpenSSL 0.9.8zh之前版本，1.0.0t之前1.0.0版本，1.0.1q之前1.0.1版本，1.0.2e之前1.0.2版本。

英文描述:

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

CWE类型:
CWE-200
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
apple mac_os_x * - - cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
oracle api_gateway 11.1.2.3.0 - - cpe:2.3:a:oracle:api_gateway:11.1.2.3.0:*:*:*:*:*:*:*
oracle api_gateway 11.1.2.4.0 - - cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*
oracle communications_webrtc_session_controller 7.0 - - cpe:2.3:a:oracle:communications_webrtc_session_controller:7.0:*:*:*:*:*:*:*
oracle communications_webrtc_session_controller 7.1 - - cpe:2.3:a:oracle:communications_webrtc_session_controller:7.1:*:*:*:*:*:*:*
oracle communications_webrtc_session_controller 7.2 - - cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*
oracle exalogic_infrastructure 1.0 - - cpe:2.3:a:oracle:exalogic_infrastructure:1.0:*:*:*:*:*:*:*
oracle exalogic_infrastructure 2.0 - - cpe:2.3:a:oracle:exalogic_infrastructure:2.0:*:*:*:*:*:*:*
oracle http_server 11.5.10.2 - - cpe:2.3:a:oracle:http_server:11.5.10.2:*:*:*:*:*:*:*
oracle life_sciences_data_hub 2.1 - - cpe:2.3:a:oracle:life_sciences_data_hub:2.1:*:*:*:*:*:*:*
oracle sun_ray_software 11.1 - - cpe:2.3:a:oracle:sun_ray_software:11.1:*:*:*:*:*:*:*
oracle transportation_management 6.1 - - cpe:2.3:a:oracle:transportation_management:6.1:*:*:*:*:*:*:*
oracle transportation_management 6.2 - - cpe:2.3:a:oracle:transportation_management:6.2:*:*:*:*:*:*:*
oracle vm_server 3.2 - - cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:*
oracle vm_virtualbox * - - cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
oracle integrated_lights_out_manager_firmware * - - cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:*
oracle linux 5 - - cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
oracle linux 6 - - cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
oracle linux 7 - - cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*
oracle solaris 10 - - cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
oracle solaris 11.3 - - cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
openssl openssl * - - cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 5.0 - - cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0 - - cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 7.0 - - cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 5.0 - - cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0 - - cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 7.0 - - cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.2 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.3 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.4 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.6 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.7 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.2 - - cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.3 - - cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.6 - - cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.7 - - cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 5.0 - - cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0 - - cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 7.0 - - cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
canonical ubuntu_linux 12.04 - - cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
canonical ubuntu_linux 14.04 - - cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
canonical ubuntu_linux 15.04 - - cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
canonical ubuntu_linux 15.10 - - cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
debian debian_linux 7.0 - - cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
debian debian_linux 8.0 - - cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
opensuse leap 42.1 - - cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
opensuse opensuse 11.4 - - cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
opensuse opensuse 13.1 - - cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
opensuse opensuse 13.2 - - cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
suse linux_enterprise_server 10 - - cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*
fedoraproject fedora 22 - - cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
无标题 OTHER
cve.org
访问
APPLE-SA-2016-03-21-5 vendor-advisory
cve.org
访问
RHSA-2016:2056 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
20151204 Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
openSUSE-SU-2015:2288 vendor-advisory
cve.org
访问
RHSA-2015:2617 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
SSA:2015-349-04 vendor-advisory
cve.org
访问
openSUSE-SU-2016:0640 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
78626 vdb-entry
cve.org
访问
RHSA-2015:2616 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
HPSBGN03536 vendor-advisory
cve.org
访问
USN-2830-1 vendor-advisory
cve.org
访问
openSUSE-SU-2015:2289 vendor-advisory
cve.org
访问
FEDORA-2015-d87d60b9a9 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
91787 vdb-entry
cve.org
访问
RHSA-2016:2957 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
1034294 vdb-entry
cve.org
访问
SUSE-SU-2016:0678 vendor-advisory
cve.org
访问
openSUSE-SU-2016:0637 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
DSA-3413 vendor-advisory
cve.org
访问
openSUSE-SU-2015:2318 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
openSUSE-SU-2015:2349 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
CVSS评分详情
5.3
MEDIUM
CVSS向量: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS版本: 3.1
机密性
NONE
完整性
NONE
可用性
LOW
时间信息
发布时间:
2015-12-06 00:00:00
修改时间:
2024-08-06 05:39:31
创建时间:
2025-11-11 15:34:02
更新时间:
2025-11-11 15:52:18
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2015-3195 2025-11-11 15:18:56 2025-11-11 07:34:02
NVD nvd_CVE-2015-3195 2025-11-11 14:54:53 2025-11-11 07:42:44
CNNVD cnnvd_CNNVD-201512-075 2025-11-11 15:09:37 2025-11-11 07:52:18
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:52:18
vulnerability_type: 未提取 → 信息泄露; cnnvd_id: 未提取 → CNNVD-201512-075; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 信息泄露
  • cnnvd_id: 未提取 -> CNNVD-201512-075
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:42:44
cvss_score: 未提取 → 5.3; cvss_vector: NOT_EXTRACTED → CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; cvss_version: NOT_EXTRACTED → 3.1; affected_products_count: 0 → 52; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • cvss_score: 未提取 -> 5.3
  • cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  • cvss_version: NOT_EXTRACTED -> 3.1
  • affected_products_count: 0 -> 52
  • data_sources: ['cve'] -> ['cve', 'nvd']