Siemens OpenSSL Vulnerability in Industrial Products (Update E)
In OpenSSL 1.0.2 an "error state" mechanism was introduced. This "error state" mechanism does not work correctly if SSL_read() or SSL_write() is called directly by an application. This could result in data being sent out unencrypted by the SSL/TLS record layer.

Successful exploitation requires an attacker to cause a fatal error in the victim's SSL/TLS handshake algorithm, and that the targeted application calls SSL_read() or SSL_write() after having already received a fatal error. No user interaction or privileges are required to exploit this security vulnerability. The vulnerability could allow to compromise confidentiality of data by transmitting it unencrypted over the network.