CVEvulnerability

CVE-2014-0160

7.5 HIGH Known exploited Published 2014-04-07 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

OpenSSL Information Disclosure Vulnerability — OpenSSL OpenSSL

The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.

Added to KEV
2022-05-04
Remediation due
2022-05-25
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2014-0160
Status
Analyzed
Published
2014-04-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-125

Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Affected configurations

• openssl openssl (>= 1.0.1 < 1.0.1g) • filezilla-project filezilla server (< 0.9.44) • siemens application processing engine firmware 2.0 • siemens cp 1543-1 firmware 1.1 • siemens simatic s7-1500 firmware 1.5 • siemens simatic s7-1500t firmware 1.5 • siemens elan-8.2 (< 8.3.3) • siemens wincc open architecture 3.12 • intellian v100 firmware 1.20 • intellian v100 firmware 1.21 • intellian v100 firmware 1.24 • intellian v60 firmware 1.15 • intellian v60 firmware 1.25 • mitel micollab 6.0 • mitel micollab 7.0 • mitel micollab 7.1 • mitel micollab 7.2 • mitel micollab 7.3 • mitel micollab 7.3.0.104 • mitel mivoice 1.1.2.5 • mitel mivoice 1.1.3.3 • mitel mivoice 1.2.0.11 • mitel mivoice 1.3.2.2 • mitel mivoice 1.4.0.102 • opensuse opensuse 12.3 • opensuse opensuse 13.1 • canonical ubuntu linux 12.04 • canonical ubuntu linux 12.10 • canonical ubuntu linux 13.10 • fedoraproject fedora 19 • fedoraproject fedora 20 • redhat gluster storage 2.1 • redhat storage 2.1 • redhat virtualization 6.0 • redhat enterprise linux desktop 6.0 • redhat enterprise linux server 6.0 • redhat enterprise linux server aus 6.5 • redhat enterprise linux server eus 6.5 • redhat enterprise linux server tus 6.5 • redhat enterprise linux workstation 6.0 • debian debian linux 6.0 • debian debian linux 7.0 • debian debian linux 8.0 • ricon s9922l firmware 16.10.3\(3794\) • broadcom symantec messaging gateway 10.6.0 • broadcom symantec messaging gateway 10.6.1 • splunk splunk (>= 6.0.0 < 6.0.3)

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

Referenced by CWE · observed example (4)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-126 Buffer Over-read weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency weakness
  • CWE-240 Improper Handling of Inconsistent Structural Elements weakness

References