5.3

CVE-2015-3195: apple mac_os_x

Modified
AliasesSUSE-SU-2015:2251-1SUSE-SU-2015:2275-1SUSE-SU-2015:2342-1
Published 06-12-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-3195 is a medium (CVSS 5.3) vulnerability in apple mac_os_x. EPSS estimates a 38.71% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (NVD)
EPSS score
38.71%
0%100%
High · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 6
DSA-3413-1MGASA-2015-0466OPENSUSE-SU-2024:10309-1OPENSUSE-SU-2024:11127-1RHSA-2015:2617SUSE-SU-2015:2230-1

Timeline

  1. 06-12-2015
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

CVSS metrics

6 scores · 4 sources · 3 versions

EPSS trend

Probability

38.71%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 38.71% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse20 products
  • compat-openssl097g&distro=SUSE Linux Enterprise Desktop 11 SP3< 0.9.7g-146.22.36.1
  • compat-openssl097g&distro=SUSE Linux Enterprise Desktop 11 SP4< 0.9.7g-146.22.36.1
  • compat-openssl097g&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP2< 0.9.7g-146.22.36.1
  • compat-openssl097g&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP3< 0.9.7g-146.22.36.1
  • compat-openssl097g&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 0.9.7g-146.22.36.1
Oracle12 products
Redhat9 products
Debian2 products
  • openssl< 1.0.2e-1 | < 0.9.8o-4squeeze22
  • debian_linuxEOL7.0 | 8.0
Opensuse2 products
Apple1 product
Canonical1 product
Fedoraproject1 product
Openssl1 product
  • openssl< 0.9.8zh | ≥ 1.0.0, < 1.0.0t | ≥ 1.0.1, < 1.0.1q | ≥ 1.0.2, < 1.0.2e
Ubuntu1 product
  • openssl< 1.0.1f-1ubuntu2.16 | < 1.0.2e-1ubuntu1

10 vendors · 50 products

References

65 links
Show all 65 references