BaseFortify

Publication date: 2014-04-07

Last updated on: 2026-04-21

Assigner: redhat-SADP

Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2014-04-07

Last Modified

2026-04-21

Generated

2026-10-16

AI Q&A

2024-11-28

EPSS Evaluated

2025-08-20

NVD

CVE-2014-0160

Affected Vendors & Products

Vendor	Product	Version / Range
openssl	openssl	From 1.0.1 (inc) to 1.0.1g (exc)
filezilla-project	filezilla_server	to 0.9.44 (exc)
siemens	application_processing_engine_firmware	2.0
siemens	application_processing_engine	*
siemens	cp_1543-1_firmware	1.1
siemens	cp_1543-1	*
siemens	simatic_s7-1500_firmware	1.5
siemens	simatic_s7-1500	*
siemens	simatic_s7-1500t_firmware	1.5
siemens	simatic_s7-1500t	*
siemens	elan-8.2	to 8.3.3 (exc)
siemens	wincc_open_architecture	3.12
intellian	v100_firmware	1.20
intellian	v100_firmware	1.21
intellian	v100_firmware	1.24
intellian	v100	*
intellian	v60_firmware	1.15
intellian	v60_firmware	1.25
intellian	v60	*
mitel	micollab	6.0
mitel	micollab	7.0
mitel	micollab	7.1
mitel	micollab	7.2
mitel	micollab	7.3
mitel	micollab	7.3.0.104
mitel	mivoice	1.1.2.5
mitel	mivoice	1.1.3.3
mitel	mivoice	1.2.0.11
mitel	mivoice	1.3.2.2
mitel	mivoice	1.4.0.102
opensuse	opensuse	12.3
opensuse	opensuse	13.1
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10
canonical	ubuntu_linux	13.10
fedoraproject	fedora	19
fedoraproject	fedora	20
redhat	gluster_storage	2.1
redhat	storage	2.1
redhat	virtualization	6.0
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server_aus	6.5
redhat	enterprise_linux_server_eus	6.5
redhat	enterprise_linux_server_tus	6.5
redhat	enterprise_linux_workstation	6.0
debian	debian_linux	6.0
debian	debian_linux	7.0
debian	debian_linux	8.0
ricon	s9922l_firmware	16.10.3\(3794\)
ricon	s9922l	1.0
broadcom	symantec_messaging_gateway	10.6.0
broadcom	symantec_messaging_gateway	10.6.1
splunk	splunk	From 6.0.0 (inc) to 6.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability, known as the Heartbleed bug, affects certain versions of OpenSSL, a widely used software for secure communications. It allows attackers to send specially crafted packets that can trick the software into revealing sensitive information, such as private keys, from the memory of the affected system.

Impact Analysis

If you use software that relies on the affected versions of OpenSSL, attackers could potentially access sensitive information, including passwords and private data. This could lead to unauthorized access to your accounts or systems, putting your personal or business information at risk.

Compliance Impact

This vulnerability could lead to breaches of sensitive data, which would violate regulations like GDPR and HIPAA that require the protection of personal and health information. If your organization is found to be non-compliant due to this vulnerability, it could face legal penalties and damage to its reputation.

Hi! I’m here to help you understand CVE-2014-0160. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70