CVE-2014-0160

Advisory lineage Upstream: 0 Downstream: 13
Analyzed
Published: 07 Apr 2014, 00:00
Last modified:22 Oct 2025, 00:05

Vulnerability Summary

Overall Risk (default)
high
59/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
94.46% CRITICAL
94% probability 0.00%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
9 found
Dark Web
Not detected

Timeline

07 Apr 2014, 00:00
Published
Vulnerability first disclosed
04 May 2022, 00:00
Added to CISA KEV
OpenSSL Information Disclosure Vulnerability
25 May 2022, 00:00
CISA Remediation Due
Apply updates per vendor instructions.
22 Oct 2025, 00:05
Last Modified
Vulnerability information updated

Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 94.46%• Percentile: 100%

Techniques & Countermeasures

  • CWE-125•Out-of-bounds Read

    The product reads data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • broadcom•symantec_messaging_gateway

    10.6.0 | 10.6.1

  • canonical•ubuntu_linux

    12.04 | 12.10 | 13.10

  • debian•debian_linux

    6.0 | 7.0 | 8.0

  • fedoraproject•fedora

    19 | 20

  • filezilla-project•filezilla_server

    < 0.9.44

  • intellian•v100_firmware

    1.20 | 1.21 | 1.24

  • intellian•v60_firmware

    1.15 | 1.25

  • Unknown•MiCollab

    6.0 | 7.0 | 7.1 | 7.2 | 7.3 | 7.3.0.104

  • mitel•mivoice

    1.1.2.5 | 1.1.3.3 | 1.2.0.11 | 1.3.2.2 | 1.4.0.102

  • Unknown•OpenSSL

    ≥ 1.0.1, < 1.0.1g

  • opensuse•opensuse

    12.3 | 13.1

  • redhat•enterprise_linux_desktop

    6.0

  • redhat•enterprise_linux_server

    6.0

  • redhat•enterprise_linux_server_aus

    6.5

  • redhat•enterprise_linux_server_eus

    6.5

  • redhat•enterprise_linux_server_tus

    6.5

  • redhat•enterprise_linux_workstation

    6.0

  • redhat•gluster_storage

    2.1

  • redhat•storage

    2.1

  • redhat•virtualization

    6.0

  • ricon•s9922l_firmware

    16.10.3\(3794\)

  • siemens•application_processing_engine_firmware

    2.0

  • siemens•cp_1543-1_firmware

    1.1

  • siemens•elan-8.2

    < 8.3.3

  • siemens•simatic_s7-1500_firmware

    1.5

  • siemens•simatic_s7-1500t_firmware

    1.5

  • siemens•wincc_open_architecture

    3.12

  • splunk•splunk

    ≥ 6.0.0, < 6.0.3

References (129)