CVE-2015-3195: Apple Mac OS X
Medium severity, CVSS 5.3. EPSS: 38.7% chance of exploitation in the next 30 days.
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
Affected products
- Apple Mac OS X: before 10.11.4 (fixed in 10.11.4)
- Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.04 only; version 15.10 only
- Debian Debian Linux: version 7.0 only; version 8.0 only
- Fedoraproject Fedora: version 22 only
- OpenSSL OpenSSL: before 0.9.8zh (fixed in 0.9.8zh); from 1.0.0, before 1.0.0t (fixed in 1.0.0t); from 1.0.1, before 1.0.1q (fixed in 1.0.1q); from 1.0.2, before 1.0.2e (fixed in 1.0.2e)
- Opensuse Leap: version 42.1 only
- Opensuse Opensuse: version 11.4 only; version 13.1 only; version 13.2 only
- Oracle API Gateway: version 11.1.2.3.0 only; version 11.1.2.4.0 only
- Oracle Communications WebRTC Session Controller: version 7.0 only; version 7.1 only; version 7.2 only
- Oracle Exalogic Infrastructure: version 1.0 only; version 2.0 only
- Oracle HTTP Server: version 11.5.10.2 only
- Oracle Integrated Lights Out Manager Firmware: from 3.0, up to and including 4.0.4
- Oracle Life Sciences Data Hub: version 2.1 only
- Oracle Linux: version 5 only; version 6 only; version 7 only
- Oracle Solaris: version 10 only; version 11.3 only
- Oracle Sun Ray Software: version 11.1 only
- Oracle Transportation Management: version 6.1 only; version 6.2 only
- Oracle Vm Server: version 3.2 only
- Oracle Vm VirtualBox: before 4.3.36 (fixed in 4.3.36); from 5.0.0, before 5.0.14 (fixed in 5.0.14)
- Red Hat Enterprise Linux Desktop: version 5.0 only; version 6.0 only; version 7.0 only
- Red Hat Enterprise Linux Server: version 5.0 only; version 6.0 only; version 7.0 only
- Red Hat Enterprise Linux Server Aus: version 7.2 only; version 7.3 only; version 7.4 only; version 7.6 only; version 7.7 only
- Red Hat Enterprise Linux Server Tus: version 7.2 only; version 7.3 only; version 7.6 only; version 7.7 only
- Red Hat Enterprise Linux Workstation: version 5.0 only; version 6.0 only; version 7.0 only
- Suse Linux Enterprise Server: version 10 only
Published 2015-12-06. Last modified 2026-06-17.