high
7.5
CWE
119
Advisory Published
CVE Published
Updated

CVE-2015-0292: Buffer Overflow

First published: Mon Mar 16 2015(Updated: )

A vulnerability existed in previous versions of OpenSSL related to the processing of base64-encoded data. Any code path that reads base64 data from an untrusted source could be affected (such as the PEM processing routines). Maliciously crafted base 64 data could trigger a segmenation fault or memory corruption. This was addressed in previous versions of OpenSSL but has not been included in any security advisory until now. This issue affects OpenSSL versions 1.0.1, 1.0.0, and 0.9.8. This issue is fixed in versions: 1.0.1h, 1.0.0m, and 0.9.8za. Acknowledgements: Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Robert Dugal and David Ramos as the original reporters.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
redhat/openssl<1.0.1
1.0.1
redhat/openssl<0.9.8
0.9.8
OpenSSL<=0.9.8z
OpenSSL=1.0.0
OpenSSL=1.0.0a
OpenSSL=1.0.0b
OpenSSL=1.0.0c
OpenSSL=1.0.0d
OpenSSL=1.0.0e
OpenSSL=1.0.0f
OpenSSL=1.0.0g
OpenSSL=1.0.0h
OpenSSL=1.0.0i
OpenSSL=1.0.0j
OpenSSL=1.0.0k
OpenSSL=1.0.0l
OpenSSL=1.0.1
OpenSSL=1.0.1a
OpenSSL=1.0.1b
OpenSSL=1.0.1c
OpenSSL=1.0.1d
OpenSSL=1.0.1e
OpenSSL=1.0.1f
OpenSSL=1.0.1g

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2015-0292?

    CVE-2015-0292 has been classified as a high severity vulnerability due to its potential to trigger segmentation faults from crafted base64 data.

  • How do I fix CVE-2015-0292?

    To fix CVE-2015-0292, update OpenSSL to version 1.0.1 or later, or apply the relevant patches from your distribution.

  • Which versions of OpenSSL are affected by CVE-2015-0292?

    CVE-2015-0292 affects OpenSSL versions 0.9.8 through 1.0.1, including all iterations of these versions.

  • What type of attacks does CVE-2015-0292 enable?

    CVE-2015-0292 can enable denial of service attacks through segmentation faults when processing maliciously crafted base64 data.

  • Is CVE-2015-0292 being actively exploited?

    As of the last reports, there have been instances of CVE-2015-0292 being exploited in the wild, highlighting the need for prompt remediation.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203