CVE-2015-0290: The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-b...

Security readout for executives and security teams

CVE-2015-0290 is an OpenSSL crash bug, not a data theft issue in the supplied sources. A remote party may be able to crash affected applications when a narrow OpenSSL 1.0.2 configuration handles certain non-blocking TLS writes. Business impact is service interruption where vulnerable OpenSSL builds remain deployed. Exposure appears limited to systems using OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES-NI, especially services using TLS with non-blocking I/O. Downstream products may be affected if they bundled or linked vulnerable OpenSSL builds. Treat as a targeted availability risk. It is lower urgency than code execution or credential exposure, but should be closed on externally reachable and critical TLS services. Mitigation focus: Upgrade OpenSSL 1.0.2 deployments to 1.0.2a or a later fixed vendor build.; Apply downstream vendor updates for products that bundle OpenSSL.; Prioritize internet-facing TLS services and high-availability systems..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.