CVE-2014-0160
- State
- Published
- Severity
- 7.5 High
- Published
- Apr 7, 2014
- Updated
- Oct 22, 2025
- Reserved
- Dec 3, 2013
Description
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-125 Out-of-bounds Read
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217
- 1030077vdb-entry
- 20140408 heartbleed OpenSSL bug CVE-2014-0160mailing-list
- http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/
- DSA-2896vendor-advisory
- HPSBGN03008vendor-advisory
- HPSBMU03024vendor-advisory
- RHSA-2014:0396vendor-advisory
- HPSBHF03021vendor-advisory
- HPSBHF03136vendor-advisory
- VU#720951third-party-advisory
- http://www.splunk.com/view/SP-CAAAMB3
- HPSBMU03033vendor-advisory
- http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
- http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf
- HPSBGN03011vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21670161
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- openSUSE-SU-2014:0492vendor-advisory
- SSRT101846vendor-advisory
- 20140409 Re: heartbleed OpenSSL bug CVE-2014-0160mailing-list
- HPSBMU03037vendor-advisory
- 1030080vdb-entry
- 57836third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=isg400001843
- HPSBMU03012vendor-advisory
- HPSBST03001vendor-advisory
- 66690vdb-entry
- http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf
- https://filezilla-project.org/versions.php?type=server
- HPSBMU03023vendor-advisory
- 57483third-party-advisory
- 20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Productsvendor-advisory
- http://www.kerio.com/support/kerio-control/release-history
- http://advisories.mageia.org/MGASA-2014-0165.html
- http://www.blackberry.com/btsc/KB35882
- HPSBMU03044vendor-advisory
- HPSBMU03030vendor-advisory
- 1030081vdb-entry
- FEDORA-2014-4879vendor-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilitiesmailing-list
- FEDORA-2014-4910vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1084875
- FEDORA-2014-9308vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=isg400001841
- HPSBMU03013vendor-advisory
- 1030079vdb-entry
- RHSA-2014:0377vendor-advisory
- HPSBMU02995vendor-advisory
- HPSBPI03031vendor-advisory
- https://code.google.com/p/mod-spdy/issues/detail?id=85
- HPSBMU02999vendor-advisory
- HPSBGN03010vendor-advisory
- HPSBMU03029vendor-advisory
- http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/
- http://heartbleed.com/
- HPSBMU03018vendor-advisory
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01
- HPSBMU03040vendor-advisory
- http://cogentdatahub.com/ReleaseNotes.html
- HPSBMU03025vendor-advisory
- HPSBST03016vendor-advisory
- HPSBMU03028vendor-advisory
- HPSBMU03009vendor-advisory
- http://www.f-secure.com/en/web/labs_global/fsc-2014-1
- TA14-098Athird-party-advisory
- 57347third-party-advisory
- [syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been releasedmailing-list
- 20140411 MRI Rubies may contain statically linked, vulnerable OpenSSLmailing-list
- https://blog.torproject.org/blog/openssl-bug-cve-2014-0160
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html
- https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html
- http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=96db9023b881d7cd9f379b0c154650d6c108e9a3
- HPSBST03000vendor-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilitiesmailing-list
- HPSBST03004vendor-advisory
- USN-2165-1vendor-advisory
- RHSA-2014:0378vendor-advisory
- HPSBMU02997vendor-advisory
- SUSE-SA:2014:002vendor-advisory
- 32764exploit
- HPSBMU02994vendor-advisory
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160512_00
- HPSBMU03022vendor-advisory
- HPSBST03027vendor-advisory
- HPSBMU03019vendor-advisory
- HPSBMU03062vendor-advisory
- 20140408 Re: heartbleed OpenSSL bug CVE-2014-0160mailing-list
- 1030078vdb-entry
- 59243third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004661
- HPSBMU03020vendor-advisory
- HPSBST03015vendor-advisory
- RHSA-2014:0376vendor-advisory
- HPSBPI03014vendor-advisory
- MDVSA-2015:062vendor-advisory
- https://www.cert.fi/en/reports/2014/vulnerability788210.html
- 57721third-party-advisory
- 57968third-party-advisory
- http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=3
- openSUSE-SU-2014:0560vendor-advisory
- HPSBMU03032vendor-advisory
- 1030082vdb-entry
- HPSBMU02998vendor-advisory
- 32745exploit
- 20140412 Re: heartbleed OpenSSL bug CVE-2014-0160mailing-list
- http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
- HPSBMU03017vendor-advisory
- https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008
- http://www.openssl.org/news/secadv_20140407.txt
- https://gist.github.com/chapmajs/10473815
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=1
- 1030074vdb-entry
- http://support.citrix.com/article/CTX140605
- 59139third-party-advisory
- http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/
- 57966third-party-advisory
- 1030026vdb-entry
- 59347third-party-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/mailing-list
- https://sku11army.blogspot.com/2020/01/heartbleed-hearts-continue-to-bleed.html
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/mailing-list
- https://cert-portal.siemens.com/productcert/pdf/ssa-635659.pdf
- [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/mailing-list
- https://yunus-shn.medium.com/ricon-industrial-cellular-router-heartbleed-attack-2634221c02bd
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0160government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.