CVE-2015-3196: canonical ubuntu_linux
Vulnerability summary
CVE-2015-3196 is a medium (CVSS 4.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 13.53% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 5Timeline
- 06-12-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
13.53%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 13.53% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat6 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.2 | 7.3 | 7.4
- enterprise_linux_server_eus6.7 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6
- enterprise_linux_server_tus7.2 | 7.3 | 7.6
Debian2 products
- openssl< 1.0.2d-1
- debian_linuxEOL7.0 | 8.0
Hp2 products
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.04 | 15.10
Fedoraproject1 product
- fedoraEOL22
Openssl1 product
- opensslEOL1.0.0 | 1.0.0a | 1.0.0b | 1.0.0c | 1.0.0d | 1.0.0e | 1.0.0f | 1.0.0g | 1.0.0h | 1.0.0i | 1.0.0j | 1.0.0k | 1.0.0l | 1.0.0m | 1.0.0n | 1.0.0o | 1.0.0p | 1.0.0q | 1.0.0r | 1.0.0s | 1.0.1 | 1.0.1a | 1.0.1b | 1.0.1c | 1.0.1d | 1.0.1e | 1.0.1f | 1.0.1g | 1.0.1h | 1.0.1i | 1.0.1j | 1.0.1k | 1.0.1l | 1.0.1m | 1.0.1n | 1.0.1o
Oracle1 product
- vm_virtualbox≥ 4.3.0, ≤ 4.3.35 | ≥ 5.0.0, ≤ 5.0.13
Ubuntu1 product
- openssl< 1.0.1f-1ubuntu2.16
8 vendors · 15 products
References
31 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-opensslVendor AdvisoryThird Party Advisory
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173Third Party Advisory
- lists.opensuse.org/opensuse-updates/2015-12/msg00070.htmlVendor AdvisoryMailing ListThird Party Advisory
- www.fortiguard.com/advisory/openssl-advisory-december-2015Third Party Advisory
- www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583Vendor AdvisoryThird Party Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
Show all 31 references
- kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100Third Party Advisory
- kb.juniper.net/InfoCenter/index?page=content&id=JSA10761Third Party Advisory
- lists.opensuse.org/opensuse-updates/2015-12/msg00071.htmlVendor AdvisoryMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.htmlVendor AdvisoryMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlThird Party Advisory
- openssl.org/news/secadv/20151203.txtVendor Advisory
- fortiguard.com/advisory/openssl-advisory-december-2015Third Party Advisory
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322Third Party Advisory
- kb.juniper.net/InfoCenter/index?page=content&id=JSA10759Third Party Advisory