CVE 2014-0160
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Related bugs and status
CVE-2014-0160 (Candidate) is related to these bugs:
Bug #1304042: CVE-2014-0160
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1304042 | CVE-2014-0160 | openssl (Ubuntu) | Undecided | Fix Released | ||
1304042 | CVE-2014-0160 | openssl (Debian) | Unknown | Fix Released |
Bug #1304457: OpenSSL packages are vulnerable to CVE-2014-0160
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1304457 | OpenSSL packages are vulnerable to CVE-2014-0160 | Raspbian | Undecided | Fix Released |
Bug #1304506: openssl vulnerable to remote memory reads (aka heartbleeed bug) - grave error
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1304506 | openssl vulnerable to remote memory reads (aka heartbleeed bug) - grave error | Raspbian | Undecided | Fix Released |
Bug #1304651: Heartbleed Bug
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1304651 | Heartbleed Bug | openssl (Ubuntu) | Undecided | Fix Released |
Bug #1307532: OpenSSL is not up-to-date in Ubuntu 13.10
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1307532 | OpenSSL is not up-to-date in Ubuntu 13.10 | openssl (Ubuntu) | Undecided | Invalid |
Bug #1440494: Raspbian openssl (1.01e) is vulnerable to CVE-2014-0160
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1440494 | Raspbian openssl (1.01e) is vulnerable to CVE-2014-0160 | Raspbian | Undecided | Invalid |
Bug #1811531: remote execution vulnerability
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1811531 | remote execution vulnerability | zeromq3 (Ubuntu) | Undecided | Fix Released | ||
1811531 | remote execution vulnerability | zeromq3 (Debian) | Unknown | Fix Released | ||
1811531 | remote execution vulnerability | zeromq (Suse) | High | Fix Released |
See the
CVE page on Mitre.org
for more details.