CVE-2014-0160
OpenSSL Information Disclosure Vulnerability
Published Apr 7, 2014 · updated Jun 16, 2026 · openssl openssl
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Timeline
Detection, updates, and resolution for this record.
Apr 7, 2014 · Catalog
Detected
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
May 4, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 25, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Required action
Apply updates per vendor instructions.
CISA due date May 25, 2022
Affected
- cpe filezilla-project/filezilla serverversion unspecified
- cpe intellian/v100 firmware1.20
- cpe intellian/v60 firmware1.15
- cpe mitel/micollab6.0
- cpe openssl/opensslversion unspecified
- cpe opensuse/opensuse12.3
- cpe siemens/application processing engine firmware2.0
- cpe siemens/cp 1543-1 firmware1.1
- cpe siemens/elan-8.2version unspecified
- cpe siemens/simatic s7-1500 firmware1.5
- cpe siemens/simatic s7-1500t firmware1.5
- cpe siemens/wincc open architecture3.12
- vendor OpenSSL OpenSSLversion unspecified
Sources
- CISA KEVCVE-2014-0160
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
cisa.gov - CVE.orgCVE-2014-0160
Official CVE identifier
cve.org - FIRST EPSSCVE-2014-0160
30-day exploitation probability 100.0%
first.org - Exploit Database32764
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database32791
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database32998
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesauxiliary_scanner/ssl/openssl_heartbleed
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - Metasploit Modulesauxiliary_server/openssl_heartbeat_client_memory
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2014-0160
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by re
nvd.nist.gov