Medium severity5.3NVD Advisory· Published Dec 6, 2015· Updated Jun 17, 2026

CVE-2015-3195

Description

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenSSL Project/OpenSSL2 versions
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*range: <0.9.8zh
- (no CPE)range: <0.9.8zh, <1.0.0t, <1.0.1q, <1.0.2e
Oracle Corporation/API Gateway2 versions
cpe:2.3:a:oracle:api_gateway:11.1.2.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:api_gateway:11.1.2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Webrtc Session Controller3 versions
cpe:2.3:a:oracle:communications_webrtc_session_controller:7.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:communications_webrtc_session_controller:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_webrtc_session_controller:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*
Oracle Corporation/Exalogic Infrastructure2 versions
cpe:2.3:a:oracle:exalogic_infrastructure:1.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:exalogic_infrastructure:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:exalogic_infrastructure:2.0:*:*:*:*:*:*:*
Oracle Corporation/HTTP Server
cpe:2.3:a:oracle:http_server:11.5.10.2:*:*:*:*:*:*:*
Oracle Corporation/Life Sciences Data Hub
cpe:2.3:a:oracle:life_sciences_data_hub:2.1:*:*:*:*:*:*:*
Oracle Corporation/Sun Ray Software
cpe:2.3:a:oracle:sun_ray_software:11.1:*:*:*:*:*:*:*
Oracle Corporation/Transportation Management2 versions
cpe:2.3:a:oracle:transportation_management:6.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:transportation_management:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:transportation_management:6.2:*:*:*:*:*:*:*
Oracle Corporation/VM Server
cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:*
Oracle Corporation/VM Virtualbox
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
Range: <4.3.36
Apple Inc./Mac OS X
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Range: <10.11.4
Canonical/Ubuntu Linux4 versions
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Fedoraproject/Fedora
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
OpenSUSE/openSUSE3 versions
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
Oracle Corporation/Integrated Lights Out Manager Firmware
cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:*
Range: >=3.0,<=4.0.4
Oracle Corporation/Linux3 versions
cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*
Oracle Corporation/Solaris2 versions
cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Desktop3 versions
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server3 versions
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus5 versions
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Tus4 versions
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation3 versions
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
SUSE S.A./Linux Enterprise Server
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*
osv-coords30 versions
pkg:rpm/opensuse/libressl&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/openssl-1_1&distro=openSUSE%20Tumbleweed pkg:rpm/suse/compat-openssl097g&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP3 pkg:rpm/suse/compat-openssl097g&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP4 pkg:rpm/suse/compat-openssl097g&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP2 pkg:rpm/suse/compat-openssl097g&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP3 pkg:rpm/suse/compat-openssl097g&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/compat-openssl098&distro=SUSE%20Linux%20Enterprise%20Desktop%2012 pkg:rpm/suse/compat-openssl098&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/compat-openssl098&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2012 pkg:rpm/suse/openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011-SECURITY pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP3 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP4 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Desktop%2012 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP2-LTSS pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATA pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2012 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP3 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP3 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012 pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1 pkg:rpm/suse/openssl&distro=SUSE%20Studio%20Onsite%201.3
< 2.5.0-1.1+ 29 more
- (no CPE)range: < 2.5.0-1.1
- (no CPE)range: < 1.1.1l-1.2
- (no CPE)range: < 0.9.7g-146.22.36.1
- (no CPE)range: < 0.9.7g-146.22.36.1
- (no CPE)range: < 0.9.7g-146.22.36.1
- (no CPE)range: < 0.9.7g-146.22.36.1
- (no CPE)range: < 0.9.7g-146.22.36.1
- (no CPE)range: < 0.9.8j-87.1
- (no CPE)range: < 0.9.8j-87.1
- (no CPE)range: < 0.9.8j-87.1
- (no CPE)range: < 1.0.1g-0.35.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 1.0.1i-27.6.1
- (no CPE)range: < 1.0.1i-36.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 1.0.1i-27.6.1
- (no CPE)range: < 1.0.1i-36.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 1.0.1i-27.6.1
- (no CPE)range: < 1.0.1i-36.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 0.9.8j-0.80.1
- (no CPE)range: < 1.0.1i-27.6.1
- (no CPE)range: < 1.0.1i-36.1
- (no CPE)range: < 0.9.8j-0.80.1

Patches

Vulnerability mechanics

References

kb.juniper.net/InfoCenter/indexnvdThird Party Advisory
kb.juniper.net/InfoCenter/indexnvdThird Party Advisory
kb.juniper.net/InfoCenter/indexnvdThird Party Advisory
lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlnvdMailing ListThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.htmlnvdThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-12/msg00070.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-12/msg00071.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-12/msg00087.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-12/msg00103.htmlnvdMailing ListThird Party Advisory
marc.infonvdMailing ListThird Party Advisory
openssl.org/news/secadv/20151203.txtnvdVendor Advisory
rhn.redhat.com/errata/RHSA-2015-2616.htmlnvdThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-2617.htmlnvdThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-2957.htmlnvdThird Party Advisory
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-opensslnvdThird Party Advisory
www.debian.org/security/2015/dsa-3413nvdThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlnvdThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlnvdThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlnvdThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlnvdThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlnvdThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlnvdThird Party Advisory
www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlnvdThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlnvdThird Party Advisory
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlnvdThird Party Advisory
www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlnvdThird Party Advisory
www.securityfocus.com/bid/78626nvdThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/91787nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1034294nvdThird Party AdvisoryVDB Entry
www.slackware.com/security/viewer.phpnvdThird Party Advisory
www.ubuntu.com/usn/USN-2830-1nvdThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplaynvdThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplaynvdThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplaynvdThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplaynvdThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplaynvdThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplaynvdThird Party Advisory
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100nvdThird Party Advisory
support.apple.com/HT206167nvdThird Party Advisory
fortiguard.com/advisory/openssl-advisory-december-2015nvdBroken Link
rhn.redhat.com/errata/RHSA-2016-2056.htmlnvdBroken Link
www.fortiguard.com/advisory/openssl-advisory-december-2015nvdBroken Link
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfnvd
git.openssl.orgnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.031
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000