rpm package
suse/openssl-3&distro=SUSE Linux Enterprise Server 15 SP4-LTSS
pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS
Vulnerabilities (34)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-68160 | Med | 4.7 | < 3.0.8-150400.4.78.1 | 3.0.8-150400.4.78.1 | Jan 27, 2026 | Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in | |
| CVE-2025-15467 | Hig | 8.8 | < 3.0.8-150400.4.78.1 | 3.0.8-150400.4.78.1 | Jan 27, 2026 | Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When | |
| CVE-2025-9230 | Hig | 7.5 | < 3.0.8-150400.4.75.1 | 3.0.8-150400.4.75.1 | Sep 30, 2025 | Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds | |
| CVE-2024-13176 | Med | 4.1 | < 3.0.8-150400.4.72.1 | 3.0.8-150400.4.72.1 | Jan 20, 2025 | Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measurin | |
| CVE-2024-4741 | Hig | 7.5 | < 3.0.8-150400.4.57.1 | 3.0.8-150400.4.57.1 | Nov 13, 2024 | Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of | |
| CVE-2024-6119 | Hig | 7.5 | < 3.0.8-150400.4.63.1 | 3.0.8-150400.4.63.1 | Sep 3, 2024 | Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can | |
| CVE-2024-41996 | Hig | 7.5 | < 3.0.8-150400.4.66.1 | 3.0.8-150400.4.66.1 | Aug 26, 2024 | Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause a | |
| CVE-2024-5535 | Cri | 9.1 | < 3.0.8-150400.4.60.1 | 3.0.8-150400.4.60.1 | Jun 27, 2024 | Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected appl | |
| CVE-2024-4603 | Med | 5.3 | < 3.0.8-150400.4.54.1 | 3.0.8-150400.4.54.1 | May 16, 2024 | Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parame | |
| CVE-2023-6237 | Med | 5.9 | < 3.0.8-150400.4.49.1 | 3.0.8-150400.4.49.1 | Apr 25, 2024 | Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an un | |
| CVE-2024-2511 | Med | 5.9 | < 3.0.8-150400.4.54.1 | 3.0.8-150400.4.54.1 | Apr 8, 2024 | Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This prob | |
| CVE-2023-50782 | — | < 3.0.8-150400.4.69.1 | 3.0.8-150400.4.69.1 | Feb 5, 2024 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. | ||
| CVE-2024-0727 | Med | 5.5 | < 3.0.8-150400.4.49.1 | 3.0.8-150400.4.49.1 | Jan 26, 2024 | Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can c | |
| CVE-2023-6129 | Med | 6.5 | < 3.0.8-150400.4.49.1 | 3.0.8-150400.4.49.1 | Jan 9, 2024 | Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether |
- affected < 3.0.8-150400.4.78.1fixed 3.0.8-150400.4.78.1
Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in
- affected < 3.0.8-150400.4.78.1fixed 3.0.8-150400.4.78.1
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When
- affected < 3.0.8-150400.4.75.1fixed 3.0.8-150400.4.75.1
Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds
- affected < 3.0.8-150400.4.72.1fixed 3.0.8-150400.4.72.1
Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measurin
- affected < 3.0.8-150400.4.57.1fixed 3.0.8-150400.4.57.1
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of
- affected < 3.0.8-150400.4.63.1fixed 3.0.8-150400.4.63.1
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can
- affected < 3.0.8-150400.4.66.1fixed 3.0.8-150400.4.66.1
Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause a
- affected < 3.0.8-150400.4.60.1fixed 3.0.8-150400.4.60.1
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected appl
- affected < 3.0.8-150400.4.54.1fixed 3.0.8-150400.4.54.1
Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parame
- affected < 3.0.8-150400.4.49.1fixed 3.0.8-150400.4.49.1
Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an un
- affected < 3.0.8-150400.4.54.1fixed 3.0.8-150400.4.54.1
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This prob
- CVE-2023-50782Feb 5, 2024affected < 3.0.8-150400.4.69.1fixed 3.0.8-150400.4.69.1
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
- affected < 3.0.8-150400.4.49.1fixed 3.0.8-150400.4.49.1
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can c
- affected < 3.0.8-150400.4.49.1fixed 3.0.8-150400.4.49.1
Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether
Page 2 of 2