GCVE - cpe:2.3:a:stunnel:stunnel:4.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:stunnel:stunnel:4.0:*:*:*:*:*:*:*

part: a version: 4.0 update: *

Vendor	Stunnel (`919884d8-77a4-5cd5-a541-2fbbee52ee89`)
Product	Stunnel (`a9734822-cf99-5dba-b3ad-fbe93e4d79b5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/stunnel4`	purl2cpe	2026-06-01 10:17:43.364135
`pkg:deb/ubuntu/stunnel4`	purl2cpe	2026-06-01 10:17:43.364136
`pkg:github/mtrojnar/stunnel`	purl2cpe	2026-06-01 10:17:43.364138
`pkg:gitlab/redhat/stunnel`	purl2cpe	2026-06-01 10:17:43.364139
`pkg:rpm/fedora/stunnel`	purl2cpe	2026-06-01 10:17:43.364140
`pkg:rpm/opensuse/stunnel`	purl2cpe	2026-06-01 10:17:43.364142

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-0016`	vulnerable	2026-06-08 05:05:10.693765	Details available stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates. Published: 2014-03-23T15:00:00.000Z Updated: 2024-08-06T08:58:26.561Z Open on db.gcve.eu Reference links https://www.stunnel.org/sdf_ChangeLog.html https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff http://www.openwall.com/lists/oss-security/2014/03/05/1 https://bugzilla.redhat.com/show_bug.cgi?id=1072180 http://www.securityfocus.com/bid/65964	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-2400`	vulnerable	2026-06-08 04:50:23.941739	Details available Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors. Published: 2008-05-22T10:00:00.000Z Updated: 2024-08-07T08:58:02.235Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/29285 http://www.vupen.com/english/advisories/2008/1568/references http://secunia.com/advisories/30297 http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000034.html http://www.securitytracker.com/id?1020049	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2003-0740`	vulnerable	2026-06-08 04:47:22.367188	Details available Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen(), which allows local users to hijack the Stunnel server. Published: 2003-09-04T04:00:00.000Z Updated: 2024-08-08T02:05:12.501Z Open on db.gcve.eu Reference links http://marc.info/?l=bugtraq&m=106260760211958&w=2 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000736 http://www.mandriva.com/security/advisories?name=MDKSA-2003:108 http://www.redhat.com/support/errata/RHSA-2003-297.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2003-0147`	vulnerable	2026-06-08 04:47:20.815193	Details available OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal). Published: 2003-03-18T05:00:00.000Z Updated: 2024-08-08T01:43:35.976Z Open on db.gcve.eu Reference links http://www.debian.org/security/2003/dsa-288 http://www.redhat.com/support/errata/RHSA-2003-101.html http://www.redhat.com/support/errata/RHSA-2003-102.html http://www.openssl.org/news/secadv_20030317.txt http://marc.info/?l=bugtraq&m=104829040921835&w=2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Stunnel 4.0

Notes

PURL mappings

Vulnerability references

Contribute