crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1
and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows remote
attackers to cause a denial of service (application crash) via crafted CBC
data.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699889>

Notes

Author	Note
jdstrand	only 1.0.1
mdeslaur	fix included in CVE-2013-0169 patches fix reverted in usn-1732-2 because of regression

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchopenssl< 1.0.1-4ubuntu5.8UNKNOWN
ubuntu12.10noarchopenssl< 1.0.1c-3ubuntu2.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	openssl	< 1.0.1-4ubuntu5.8	UNKNOWN
ubuntu	12.10	noarch	openssl	< 1.0.1c-3ubuntu2.3	UNKNOWN

References

www.openssl.org/news/secadv_20130204.txt

launchpad.net/bugs/cve/CVE-2012-2686

nvd.nist.gov/vuln/detail/CVE-2012-2686

security-tracker.debian.org/tracker/CVE-2012-2686

ubuntu.com/security/notices/USN-1732-1

ubuntu.com/security/notices/USN-1732-3

www.cve.org/CVERecord?id=CVE-2012-2686

openvas 30

nessus 42

ubuntu 3

freebsd 2

ibm 30

slackware 2

f5 13

prion 11

veracode 4

debiancve 6

openssl 3

checkpoint_advisories 1

cve 11

securityvulns 5

ubuntucve 9

hackerone 1

suse 3

altlinux 5

osv 4

centos 2

fedora 2

oraclelinux 2

amazon 2

redhat 3

alpinelinux 2

github 1

openvas

Ubuntu Update for openssl USN-1732-3

2013-03-28 00:00:00

Ubuntu Update for openssl USN-1732-3

2013-03-28 00:00:00

Ubuntu Update for openssl USN-1732-2

2013-03-05 00:00:00

nessus

Ubuntu 12.04 LTS / 12.10 : openssl vulnerability (USN-1732-3)

2013-03-26 00:00:00

Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : openssl vulnerabilities (USN-1732-1)

2013-02-22 00:00:00

Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : openssl (SSA:2013-040-01)

2013-02-11 00:00:00

ubuntu

OpenSSL regression

2013-02-28 00:00:00

OpenSSL vulnerability

2013-03-25 00:00:00

OpenSSL vulnerabilities

2013-02-21 00:00:00

freebsd

OpenSSL -- TLS 1.1, 1.2 denial of service

2013-02-05 00:00:00

FreeBSD -- OpenSSL multiple vulnerabilities

2013-04-02 00:00:00

ibm

Security Bulletin: Vulnerabilities in ClearCase OpenSSL Component (CVE-2013-0169, CVE-2012-2686, CVE-2013-0166)

2018-06-17 04:46:06

Security Bulletin: Tivoli Management Framework affected by vulnerabilities in OpenSSL 1.0.1c

2022-09-25 21:06:56

Security Bulletin: IBM Tivoli Netcool System Service Monitors/Application Service Monitors is affected by multiple OpenSSL vulnerabilities

2022-09-26 05:45:55

slackware

openssl

2013-02-09 15:03:57

openssl

2013-02-11 23:49:59

SOL14236 - OpenSSL vulnerability CVE-2012-2686

2013-02-21 00:00:00

K14236 : OpenSSL vulnerability CVE-2012-2686

2013-09-25 00:00:00

K14190 : TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169

2015-04-30 00:00:00

prion

Code injection

2013-02-08 19:55:00

Design/Logic Flaw

2013-02-08 19:55:00

Design/Logic Flaw

2013-02-08 19:55:00

veracode

Denial Of Service (DoS)

2017-02-08 23:58:35

Timing Attacks

2017-02-10 05:59:15

Timing Side- Channel Attack

2019-01-15 08:52:54

debiancve

CVE-2012-2686

2013-02-08 19:55:00

CVE-2013-0169

2013-02-08 19:55:00

CVE-2013-1620

2013-02-08 19:55:00

openssl

Vulnerability in OpenSSL CVE-2012-2686

2013-02-05 00:00:00

Vulnerability in OpenSSL CVE-2013-0169

2013-02-04 00:00:00

Vulnerability in OpenSSL CVE-2016-2107

2016-05-03 00:00:00

checkpoint_advisories

OpenSSL AES-NI Integer Underflow (CVE-2012-2686)

2013-06-30 00:00:00

cve

CVE-2012-2686

2013-02-08 19:55:00

CVE-2013-0169

2013-02-08 19:55:00

CVE-2013-1623

2013-02-08 19:55:00

securityvulns

ESA-2013-032 RSA BSAFE® Micro Edition Suite Security Update for SSL/TLS Plaintext Recovery (aka “Lucky Thirteen”) Vulnerability

2013-07-15 00:00:00

ESA-2013-045: RSA BSAFE® SSL-C Security Update for SSL/TLS Plaintext Recovery (aka “Lucky Thirteen”) Vulnerability

2013-07-15 00:00:00

ESA-2013-039: RSA BSAFE® SSL-J Multiple Vulnerabilities

2014-04-07 00:00:00

ubuntucve

CVE-2013-0169

2013-02-08 00:00:00

CVE-2013-1619

2013-02-08 00:00:00

CVE-2013-1624

2013-02-08 00:00:00

hackerone

Legal Robot: LUCKY13 (CVE-2013-0169) effects legalrobot.com

2017-07-30 20:00:47

suse

java-1_6_0-openjdk: update to icedtea 1.12.3 (important)

2013-03-01 18:04:30

Security update for Java (important)

2013-02-22 20:04:33

java-1_6_0-openjdk: update to icedtea 1.12.3 (important)

2013-03-01 17:04:41

altlinux

Security fix for the ALT Linux 9 package openssl10 version 1.0.0k-alt1

2013-02-27 00:00:00

Security fix for the ALT Linux 9 package openssl1.1 version 1.0.0k-alt1

2013-02-27 00:00:00

Security fix for the ALT Linux 6 package openssl10 version 1.0.0k-alt1

2013-02-27 00:00:00

osv

CVE-2016-2107

2016-05-05 01:59:00

Improper Input Validation in Bouncy Castle

2022-05-14 02:14:04

openssl - several vulnerabilities

2013-02-13 00:00:00

centos

java security update

2013-02-20 20:11:32

java security update

2013-02-20 20:33:43

fedora

[SECURITY] Fedora 18 Update: mingw-openssl-1.0.1e-1.fc18

2013-04-03 04:51:11

[SECURITY] Fedora 18 Update: openssl-1.0.1e-3.fc18

2013-03-02 19:55:52

oraclelinux

java-1.6.0-openjdk security update

2013-02-20 00:00:00

java-1.6.0-openjdk security update

2013-02-20 00:00:00

amazon

Critical: openssl

2014-04-07 17:26:00

Important: java-1.6.0-openjdk

2013-03-02 16:50:00

redhat

(RHSA-2013:0783) Moderate: openssl security update

2013-05-01 17:58:17

(RHSA-2013:0274) Important: java-1.6.0-openjdk security update

2013-02-20 00:00:00

(RHSA-2013:0273) Critical: java-1.6.0-openjdk security update

2013-02-20 00:00:00

alpinelinux

CVE-2016-2107

2016-05-05 01:59:00

CVE-2018-0497

2018-07-28 17:29:00

github

Improper Input Validation in Bouncy Castle

2022-05-14 02:14:04

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.183 Low

EPSS

Percentile

96.1%

JSON

Related for UB:CVE-2012-2686