5
CVSSv2

CVE-2014-3505

Published: 13/08/2014 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 prior to 0.9.8zb, 1.0.0 prior to 1.0.0n, and 1.0.1 prior to 1.0.1i allows remote malicious users to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.

Vulnerable Product Search on Vulmon Subscribe to Product

openssl openssl 0.9.8b

openssl openssl 0.9.8m

openssl openssl 1.0.1

openssl openssl 0.9.8c

openssl openssl 1.0.0c

openssl openssl 1.0.0i

openssl openssl 1.0.0

openssl openssl 1.0.1h

openssl openssl 0.9.8n

openssl openssl 0.9.8p

openssl openssl 1.0.0m

openssl openssl 1.0.1c

openssl openssl 0.9.8e

openssl openssl 0.9.8u

openssl openssl 0.9.8za

openssl openssl 1.0.1g

openssl openssl 0.9.8g

openssl openssl 1.0.0h

openssl openssl 0.9.8k

openssl openssl 0.9.8d

openssl openssl 1.0.0e

openssl openssl 1.0.0f

openssl openssl 0.9.8j

openssl openssl 1.0.0d

openssl openssl 1.0.0j

openssl openssl 0.9.8s

openssl openssl 1.0.1a

openssl openssl 0.9.8l

openssl openssl 1.0.1d

openssl openssl 1.0.0k

openssl openssl 0.9.8r

openssl openssl 0.9.8t

openssl openssl 0.9.8a

openssl openssl 1.0.1b

openssl openssl 0.9.8o

openssl openssl 0.9.8q

openssl openssl 0.9.8w

openssl openssl 1.0.1e

openssl openssl 0.9.8

openssl openssl 1.0.1f

openssl openssl 1.0.0l

openssl openssl 0.9.8v

openssl openssl 0.9.8i

openssl openssl 0.9.8f

openssl openssl 0.9.8y

openssl openssl 1.0.0a

openssl openssl 0.9.8h

openssl openssl 0.9.8x

openssl openssl 1.0.0b

openssl openssl 1.0.0g

Vendor Advisories

Several security issues were fixed in OpenSSL ...
Multiple vulnerabilities have been identified in OpenSSL, a Secure Sockets Layer toolkit, that may result in denial of service (application crash, large memory consumption), information leak, protocol downgrade Additionally, a buffer overrun affecting only applications explicitly set up for SRP has been fixed (CVE-2014-3512) Detailed descriptions ...
A flaw was discovered in the way OpenSSL handled DTLS packets A remote attacker could use this flaw to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory Multiple buffer overflows in crypto/srp/srp_libc in the SRP implementation in OpenSSL 101 before 101i allow remote attackers to cause a denial of servi ...

References

NVD-CWE-Otherhttps://www.openssl.org/news/secadv_20140806.txthttp://linux.oracle.com/errata/ELSA-2014-1053.htmlhttp://secunia.com/advisories/60687http://secunia.com/advisories/59221http://secunia.com/advisories/60824http://secunia.com/advisories/60917ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.aschttp://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.aschttp://secunia.com/advisories/60938http://secunia.com/advisories/60921http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1297.htmlhttp://www.debian.org/security/2014/dsa-2998http://marc.info/?l=bugtraq&m=140853041709441&w=2http://marc.info/?l=bugtraq&m=141077370928502&w=2http://rhn.redhat.com/errata/RHSA-2014-1256.htmlhttp://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htmhttp://secunia.com/advisories/61775http://secunia.com/advisories/61959http://www-01.ibm.com/support/docview.wss?uid=swg21686997http://security.gentoo.org/glsa/glsa-201412-39.xmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlhttps://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.htmlhttp://secunia.com/advisories/58962http://secunia.com/advisories/59700http://secunia.com/advisories/59710http://secunia.com/advisories/59743http://secunia.com/advisories/60022http://secunia.com/advisories/60221http://secunia.com/advisories/60493http://secunia.com/advisories/60684http://secunia.com/advisories/60778http://secunia.com/advisories/60803http://secunia.com/advisories/61040http://secunia.com/advisories/61100http://secunia.com/advisories/61184http://secunia.com/advisories/61250http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15573.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2014:158http://www.securityfocus.com/bid/69081http://www.securitytracker.com/id/1030693http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240http://www-01.ibm.com/support/docview.wss?uid=swg21683389http://marc.info/?l=bugtraq&m=142660345230545&w=2http://secunia.com/advisories/59756http://www-01.ibm.com/support/docview.wss?uid=swg21682293http://linux.oracle.com/errata/ELSA-2014-1052.htmlhttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=bff1ce4e6a1c57c3d0a5f9e4f85ba6385fccfe8bhttps://usn.ubuntu.com/2308-1/https://nvd.nist.gov