# CVE-2014-0160 (Heartbleed)

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

- Page: https://www.vulneraibility.com/cve/CVE-2014-0160
- CVSS: 7.5
- Known exploited: yes, in CISA KEV since 2022-05-04; CISA due date 2022-05-25
- EPSS: 100.00% (percentile 100.0)
- Public exploit code: 4 on Exploit-DB · 2 Metasploit modules · 75 GitHub proofs of concept (first 2014-04-07)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2025-02-07)
- Weakness: CWE-125
- Published: 2014-04-07

## Affected

- openssl:openssl
- filezilla-project:filezilla_server
- siemens:application_processing_engine_firmware
- siemens:cp_1543-1_firmware
- siemens:simatic_s7-1500_firmware
- siemens:simatic_s7-1500t_firmware
- siemens:elan-8.2
- siemens:wincc_open_architecture
- intellian:v100_firmware
- intellian:v60_firmware
- mitel:micollab
- mitel:mivoice
- opensuse:opensuse
- canonical:ubuntu_linux
- fedoraproject:fedora
- redhat:gluster_storage
- redhat:storage
- redhat:virtualization
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_eus
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_workstation
- debian:debian_linux
- ricon:s9922l_firmware
- broadcom:symantec_messaging_gateway
- splunk:splunk

## References

- [other] https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217
- [other] http://www.securitytracker.com/id/1030077
- [other] http://seclists.org/fulldisclosure/2014/Apr/90
- [other] http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/
- [advisory] http://www.debian.org/security/2014/dsa-2896
- [advisory] http://marc.info/?l=bugtraq&m=139774054614965&w=2
- [advisory] http://marc.info/?l=bugtraq&m=139889113431619&w=2
- [advisory] http://rhn.redhat.com/errata/RHSA-2014-0396.html
- [advisory] http://marc.info/?l=bugtraq&m=139835815211508&w=2
- [advisory] http://marc.info/?l=bugtraq&m=141287864628122&w=2
- [advisory] http://www.kb.cert.org/vuls/id/720951
- [other] http://www.splunk.com/view/SP-CAAAMB3
- [advisory] http://marc.info/?l=bugtraq&m=139905295427946&w=2
- [other] http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
- [other] http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf
- [advisory] http://marc.info/?l=bugtraq&m=139833395230364&w=2
- [other] http://www-01.ibm.com/support/docview.wss?uid=swg21670161
- [other] http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html
- [advisory] http://marc.info/?l=bugtraq&m=142660345230545&w=2
- [other] http://seclists.org/fulldisclosure/2014/Apr/109
- [advisory] http://marc.info/?l=bugtraq&m=140724451518351&w=2
- [other] http://www.securitytracker.com/id/1030080
- [advisory] http://secunia.com/advisories/57836
- [other] http://www-01.ibm.com/support/docview.wss?uid=isg400001843
- [advisory] http://marc.info/?l=bugtraq&m=139808058921905&w=2
- [advisory] http://marc.info/?l=bugtraq&m=139758572430452&w=2
- [other] http://www.securityfocus.com/bid/66690
- [other] http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf
- [other] https://filezilla-project.org/versions.php?type=server
- [advisory] http://marc.info/?l=bugtraq&m=139843768401936&w=2
- [advisory] http://secunia.com/advisories/57483
- [advisory] http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed
- [other] http://www.kerio.com/support/kerio-control/release-history
- [other] http://advisories.mageia.org/MGASA-2014-0165.html
- [other] http://www.blackberry.com/btsc/KB35882
- [advisory] http://marc.info/?l=bugtraq&m=140075368411126&w=2
- [advisory] http://marc.info/?l=bugtraq&m=139905351928096&w=2
- [other] http://www.securitytracker.com/id/1030081
- [advisory] http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html
- [other] http://www.securityfocus.com/archive/1/534161/100/0/threaded
- [advisory] http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html
- [other] https://bugzilla.redhat.com/show_bug.cgi?id=1084875
- [advisory] http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
- [other] http://www-01.ibm.com/support/docview.wss?uid=isg400001841
- [advisory] http://marc.info/?l=bugtraq&m=139824993005633&w=2
- [other] http://www.securitytracker.com/id/1030079
- [advisory] http://rhn.redhat.com/errata/RHSA-2014-0377.html
- [advisory] http://marc.info/?l=bugtraq&m=139722163017074&w=2
- [advisory] http://marc.info/?l=bugtraq&m=139889295732144&w=2

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.