● CVE — Medium
CVE-2015-3195
Vendordebian, suse, fedoraproject, canonical, redhatProductdebian linux, linux enterprise server, fedora, ubuntu linux, enterprise linux server, enterprise linux server aus, enterprise linux server tus, solaris, leap, enterprise linux desktop, enterprise linux workstation, http server, integrated lights out manager firmware, transportation management, vm virtualbox, communications webrtc session controller, mac os x, opensuse, openssl, api gateway, linux, vm server, exalogic infrastructure, life sciences data hub, sun ray softwareDiscoveredDec 6, 2015UpdatedMay 6, 2026
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.