GCVE - cpe:2.3:a:openssl:openssl:0.9.8y:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openssl:openssl:0.9.8y:*:*:*:*:*:*:*

part: a version: 0.9.8y update: *

Vendor	Openssl (`1e7bcbe3-aabe-50a4-8853-ff7f6ce8bd02`)
Product	Openssl (`3ac33f6d-3ea6-5807-a2fa-788d3707f5b1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/openssl`	purl2cpe	2026-06-01 10:18:22.969750
`pkg:deb/ubuntu/openssl`	purl2cpe	2026-06-01 10:18:22.969751
`pkg:github/openssl/openssl`	purl2cpe	2026-06-01 10:18:22.969752
`pkg:rpm/centos/openssl`	purl2cpe	2026-06-01 10:18:22.969754
`pkg:rpm/fedora/openssl`	purl2cpe	2026-06-01 10:18:22.969755
`pkg:rpm/opensuse/openssl`	purl2cpe	2026-06-01 10:18:22.969756

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-3735`	vulnerable	2026-06-08 05:09:36.114601	Details available While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. Published: 2017-08-28T19:00:00.000Z Updated: 2024-09-16T21:08:28.987Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1039726 https://usn.ubuntu.com/3611-2/ https://www.debian.org/security/2017/dsa-4018 https://security.gentoo.org/glsa/201712-03 https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3566`	vulnerable	2026-06-08 05:05:33.500467	Details available The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Published: 2014-10-15T00:00:00.000Z Updated: 2026-05-28T17:35:01.304Z Open on db.gcve.eu Reference links http://marc.info/?l=bugtraq&m=142103967620673&w=2 http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc http://www.securitytracker.com/id/1031090 http://blog.nodejs.org/2014/10/23/node-v0-10-33-stable/ http://rhn.redhat.com/errata/RHSA-2014-1880.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3510`	vulnerable	2026-06-08 05:05:33.156007	Details available The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite. Published: 2014-08-13T23:00:00.000Z Updated: 2024-08-06T10:43:06.162Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2014-1297.html http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html http://linux.oracle.com/errata/ELSA-2014-1052.html http://secunia.com/advisories/60221 http://www-01.ibm.com/support/docview.wss?uid=swg21682293	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3508`	vulnerable	2026-06-08 05:05:33.152087	Details available The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions. Published: 2014-08-13T23:00:00.000Z Updated: 2024-08-06T10:43:06.460Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2014-1297.html http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html http://marc.info/?l=bugtraq&m=140973896703549&w=2 http://secunia.com/advisories/61214 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=0042fb5fd1c9d257d713b15a1f45da05cf5c1c87	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3507`	vulnerable	2026-06-08 05:05:33.149509	Details available Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function. Published: 2014-08-13T23:00:00.000Z Updated: 2024-08-06T10:43:06.463Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html http://linux.oracle.com/errata/ELSA-2014-1052.html http://secunia.com/advisories/60221 http://www-01.ibm.com/support/docview.wss?uid=swg21682293 http://secunia.com/advisories/60778	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3506`	vulnerable	2026-06-08 05:05:33.147053	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3505`	vulnerable	2026-06-08 05:05:33.127884	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0076`	vulnerable	2026-06-08 05:05:11.241818	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.