Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2013-0166
HistoryFeb 08, 2013 - 7:55 p.m.

CVE-2013-0166

2013-02-0819:55:00
CWE-310
[email protected]
web.nvd.nist.gov
88
openssl
signature
verification
vulnerability
denial of service
null pointer dereference
application crash
cve-2013-0166

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.4

Confidence

High

EPSS

0.007

Percentile

80.1%

JSON

OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.

Affected configurations

NVD
Node
opensslopensslMatch0.9.1c
OR
opensslopensslMatch0.9.2b
OR
opensslopensslMatch0.9.3
OR
opensslopensslMatch0.9.3a
OR
opensslopensslMatch0.9.4
OR
opensslopensslMatch0.9.5
OR
opensslopensslMatch0.9.5beta1
OR
opensslopensslMatch0.9.5beta2
OR
opensslopensslMatch0.9.5a
OR
opensslopensslMatch0.9.5abeta1
OR
opensslopensslMatch0.9.5abeta2
OR
opensslopensslMatch0.9.6
OR
opensslopensslMatch0.9.6beta1
OR
opensslopensslMatch0.9.6beta2
OR
opensslopensslMatch0.9.6beta3
OR
opensslopensslMatch0.9.6a
OR
opensslopensslMatch0.9.6abeta1
OR
opensslopensslMatch0.9.6abeta2
OR
opensslopensslMatch0.9.6abeta3
OR
opensslopensslMatch0.9.6b
OR
opensslopensslMatch0.9.6c
OR
opensslopensslMatch0.9.6d
OR
opensslopensslMatch0.9.6e
OR
opensslopensslMatch0.9.6f
OR
opensslopensslMatch0.9.6g
OR
opensslopensslMatch0.9.6h
OR
opensslopensslMatch0.9.6i
OR
opensslopensslMatch0.9.6j
OR
opensslopensslMatch0.9.6k
OR
opensslopensslMatch0.9.6l
OR
opensslopensslMatch0.9.6m
OR
opensslopensslMatch0.9.7
OR
opensslopensslMatch0.9.7beta1
OR
opensslopensslMatch0.9.7beta2
OR
opensslopensslMatch0.9.7beta3
OR
opensslopensslMatch0.9.7beta4
OR
opensslopensslMatch0.9.7beta5
OR
opensslopensslMatch0.9.7beta6
OR
opensslopensslMatch0.9.7a
OR
opensslopensslMatch0.9.7b
OR
opensslopensslMatch0.9.7c
OR
opensslopensslMatch0.9.7d
OR
opensslopensslMatch0.9.7e
OR
opensslopensslMatch0.9.7f
OR
opensslopensslMatch0.9.7g
OR
opensslopensslMatch0.9.7h
OR
opensslopensslMatch0.9.7i
OR
opensslopensslMatch0.9.7j
OR
opensslopensslMatch0.9.7k
OR
opensslopensslMatch0.9.7l
OR
opensslopensslMatch0.9.7m
OR
opensslopensslMatch0.9.8
OR
opensslopensslMatch0.9.8a
OR
opensslopensslMatch0.9.8b
OR
opensslopensslMatch0.9.8c
OR
opensslopensslMatch0.9.8d
OR
opensslopensslMatch0.9.8e
OR
opensslopensslMatch0.9.8f
OR
opensslopensslMatch0.9.8g
OR
opensslopensslMatch0.9.8h
OR
opensslopensslMatch0.9.8i
OR
opensslopensslMatch0.9.8j
OR
opensslopensslMatch0.9.8k
OR
opensslopensslMatch0.9.8l
OR
opensslopensslMatch0.9.8m
OR
opensslopensslMatch0.9.8mbeta1
OR
opensslopensslMatch0.9.8n
OR
opensslopensslMatch0.9.8o
OR
opensslopensslMatch0.9.8p
OR
opensslopensslMatch0.9.8q
OR
opensslopensslMatch0.9.8r
OR
opensslopensslMatch0.9.8s
OR
opensslopensslMatch0.9.8t
OR
opensslopensslMatch0.9.8u
OR
opensslopensslMatch0.9.8v
OR
opensslopensslMatch0.9.8w
OR
opensslopensslMatch0.9.8x
OR
opensslopensslMatch1.0.0
OR
opensslopensslMatch1.0.0a
OR
opensslopensslMatch1.0.0b
OR
opensslopensslMatch1.0.0c
OR
opensslopensslMatch1.0.0d
OR
opensslopensslMatch1.0.0e
OR
opensslopensslMatch1.0.0f
OR
opensslopensslMatch1.0.0g
OR
opensslopensslMatch1.0.0h
OR
opensslopensslMatch1.0.0i
OR
opensslopensslMatch1.0.0j
OR
opensslopensslMatch1.0.1
OR
opensslopensslMatch1.0.1a
OR
opensslopensslMatch1.0.1b
OR
opensslopensslMatch1.0.1c
OR
redhatopensslMatch0.9.6-15
OR
redhatopensslMatch0.9.6b-3
OR
redhatopensslMatch0.9.7a-2
VendorProductVersionCPE
opensslopenssl0.9.8ccpe:/a:openssl:openssl:0.9.8c:::
opensslopenssl0.9.6bcpe:/a:openssl:openssl:0.9.6b:::
opensslopenssl0.9.8lcpe:/a:openssl:openssl:0.9.8l:::
opensslopenssl0.9.8ocpe:/a:openssl:openssl:0.9.8o:::
opensslopenssl1.0.0cpe:/a:openssl:openssl:1.0.0:::
opensslopenssl0.9.8dcpe:/a:openssl:openssl:0.9.8d:::
opensslopenssl1.0.1ccpe:/a:openssl:openssl:1.0.1c:::
opensslopenssl0.9.8tcpe:/a:openssl:openssl:0.9.8t:::
opensslopenssl0.9.8ucpe:/a:openssl:openssl:0.9.8u:::
opensslopenssl0.9.8mcpe:/a:openssl:openssl:0.9.8m:beta1::
Rows per page:
1-10 of 951

References

Related

f5 2
prion 1
nessus 49
nvd 1
veracode 1
openvas 32
openssl 1
debiancve 1
ubuntucve 1
cvelist 1
altlinux 5
freebsd 2
osv 1
redhat 5
aix 1
debian 1
fedora 2
freebsd_advisory 1
amazon 1
centos 1
ibm 13
oraclelinux 5
slackware 1
ubuntu 1
securityvulns 2
vmware 2
gentoo 1
cert 1
suse 2
lenovo 2
f5
f5
K14261 : OpenSSL OCSP vulnerability CVE-2013-0166
2014-04-03 00:00:00
SOL14261 - OpenSSL OCSP vulnerability CVE-2013-0166
2013-03-07 00:00:00
prion
prion
Null pointer dereference
2013-02-08 19:55:00
nessus
nessus
F5 Networks BIG-IP : OpenSSL OCSP vulnerability (SOL14261)
2014-10-10 00:00:00
Debian DSA-2621-1 : openssl - several vulnerabilities
2013-02-14 00:00:00
Oracle Solaris Third-Party Patch Update : openssl (lucky_thirteen_vulnerability_in_solaris)
2015-01-19 00:00:00
nvd
nvd
CVE-2013-0166
2013-02-08 19:55:00
veracode
veracode
Denial Of Service (DoS) Through Null Pointer Dereference
2017-02-08 05:51:39
openvas
openvas
OpenSSL: OCSP Invalid Key DoS Issue (20130205) - Windows
2021-08-17 00:00:00
OpenSSL: OCSP Invalid Key DoS Issue (20130205) - Linux
2021-08-17 00:00:00
Debian: Security Advisory (DSA-2621-1)
2013-02-12 00:00:00
openssl
openssl
Vulnerability in OpenSSL CVE-2013-0166
2013-02-05 00:00:00
debiancve
debiancve
CVE-2013-0166
2013-02-08 19:55:00
ubuntucve
ubuntucve
CVE-2013-0166
2013-02-08 00:00:00
cvelist
cvelist
CVE-2013-0166
2013-02-08 19:00:00
altlinux
altlinux
Security fix for the ALT Linux 7 package openssl10 version 1.0.0k-alt1
2013-02-27 00:00:00
Security fix for the ALT Linux 6 package openssl10 version 1.0.0k-alt1
2013-02-27 00:00:00
Security fix for the ALT Linux 9 package openssl10 version 1.0.0k-alt1
2013-02-27 00:00:00
freebsd
freebsd
FreeBSD -- OpenSSL multiple vulnerabilities
2013-04-02 00:00:00
OpenSSL -- TLS 1.1, 1.2 denial of service
2013-02-05 00:00:00
osv
osv
openssl - several vulnerabilities
2013-02-13 00:00:00
redhat
redhat
(RHSA-2013:0783) Moderate: openssl security update
2013-05-01 17:58:17
(RHSA-2013:0587) Moderate: openssl security update
2013-03-04 00:00:00
(RHSA-2014:0416) Important: rhevm-spice-client security update
2014-04-17 00:00:00
aix
aix
Multiple OpenSSL vulnerabilities
2013-03-15 03:20:11
debian
debian
[SECURITY] [DSA 2621-1] openssl security update
2013-02-13 20:07:41
fedora
fedora
[SECURITY] Fedora 18 Update: openssl-1.0.1e-3.fc18
2013-03-02 19:55:52
[SECURITY] Fedora 17 Update: openssl-1.0.0k-1.fc17
2013-03-08 00:02:36
freebsd_advisory
freebsd_advisory
FreeBSD-SA-13:03.openssl
2013-04-02 00:00:00
amazon
amazon
Medium: openssl
2013-03-14 22:04:00
centos
centos
openssl security update
2013-03-04 22:46:45
ibm
ibm
Security Bulletin: IBM Tivoli Network Manager - GSKit Security Vulnerabilities (CVE-2013-0169), (CVE-2012-2190) and (CVE-2013-0166)
2018-06-17 14:37:51
Security Bulletin: IBM Smart Analytics System 1050, 2050, and 5600 and IBM InfoSphere Balanced Warehouse C3000, C4000, and D5100 are affected by vulnerabilities in OpenSSL (CVE-2013-0166, CVE-2013-0169)
2022-09-25 23:13:40
Security Bulletin: Vulnerabilities in ClearCase OpenSSL Component (CVE-2013-0169, CVE-2012-2686, CVE-2013-0166)
2018-06-17 04:46:06
oraclelinux
oraclelinux
openssl security update
2013-03-04 00:00:00
openssl-fips security update
2015-04-02 00:00:00
openssl security update
2021-04-01 00:00:00
slackware
slackware
openssl
2013-02-09 15:03:57
ubuntu
ubuntu
OpenSSL vulnerabilities
2013-02-21 00:00:00
securityvulns
securityvulns
OpenSSL / PolarSSL / GnuTLS security vulnerabilities
2013-03-02 00:00:00
APPLE-SA-2013-09-12-1 OS X Mountain Lion v10.8.5 and Security Update 2013-004
2013-10-03 00:00:00
vmware
vmware
VMware vSphere, ESX and ESXi updates to third party libraries
2013-07-31 00:00:00
VMware vSphere, ESX and ESXi updates to third party libraries
2013-07-31 00:00:00
gentoo
gentoo
OpenSSL: Multiple Vulnerabilities
2013-12-03 00:00:00
cert
cert
Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL
2013-03-18 00:00:00
suse
suse
Security update for compat-openssl097g (important)
2015-03-24 00:05:09
Security update for libopenssl0_9_8 (important)
2016-03-03 14:11:44
lenovo
lenovo
IntelĀ® PROSet/Wireless WiFi Software Vulnerabilities - US
2018-11-13 17:10:51
IntelĀ® PROSet/Wireless WiFi Software Vulnerabilities - Lenovo Support US
2018-11-13 17:10:51

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.4

Confidence

High

EPSS

0.007

Percentile

80.1%

JSON
Related for CVE-2013-0166
f52prion1nessus49nvd1veracode1openvas32openssl1debiancve1ubuntucve1cvelist1altlinux5freebsd2osv1redhat5aix1debian1fedora2freebsd_advisory1amazon1centos1ibm13oraclelinux5slackware1ubuntu1securityvulns2vmware2gentoo1cert1suse2lenovo2