5
CVSSv2

CVE-2014-3507

Published: 13/08/2014 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 prior to 0.9.8zb, 1.0.0 prior to 1.0.0n, and 1.0.1 prior to 1.0.1i allows remote malicious users to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openssl openssl 0.9.8b

openssl openssl 0.9.8m

openssl openssl 1.0.1

openssl openssl 0.9.8c

openssl openssl 1.0.0c

openssl openssl 1.0.0i

openssl openssl 1.0.0

openssl openssl 1.0.1h

openssl openssl 0.9.8n

openssl openssl 0.9.8p

openssl openssl 1.0.0m

openssl openssl 1.0.1c

openssl openssl 0.9.8e

openssl openssl 0.9.8u

openssl openssl 0.9.8za

openssl openssl 1.0.1g

openssl openssl 0.9.8g

openssl openssl 1.0.0h

openssl openssl 0.9.8k

openssl openssl 0.9.8d

openssl openssl 1.0.0e

openssl openssl 1.0.0f

openssl openssl 0.9.8j

openssl openssl 1.0.0d

openssl openssl 1.0.0j

openssl openssl 0.9.8s

openssl openssl 1.0.1a

openssl openssl 0.9.8l

openssl openssl 1.0.1d

openssl openssl 1.0.0k

openssl openssl 0.9.8r

openssl openssl 0.9.8t

openssl openssl 0.9.8a

openssl openssl 1.0.1b

openssl openssl 0.9.8o

openssl openssl 0.9.8q

openssl openssl 0.9.8w

openssl openssl 1.0.1e

openssl openssl 0.9.8

openssl openssl 1.0.1f

openssl openssl 1.0.0l

openssl openssl 0.9.8v

openssl openssl 0.9.8i

openssl openssl 0.9.8f

openssl openssl 0.9.8y

openssl openssl 1.0.0a

openssl openssl 0.9.8h

openssl openssl 0.9.8x

openssl openssl 1.0.0b

openssl openssl 1.0.0g

Vendor Advisories

Several security issues were fixed in OpenSSL ...
Multiple vulnerabilities have been identified in OpenSSL, a Secure Sockets Layer toolkit, that may result in denial of service (application crash, large memory consumption), information leak, protocol downgrade Additionally, a buffer overrun affecting only applications explicitly set up for SRP has been fixed (CVE-2014-3512) Detailed descriptions ...
A flaw was discovered in the way OpenSSL handled DTLS packets A remote attacker could use this flaw to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory Multiple buffer overflows in crypto/srp/srp_libc in the SRP implementation in OpenSSL 101 before 101i allow remote attackers to cause a denial of servi ...

Github Repositories

ahrf - [a]scii (or [a]wk) [h]uman [r]eadable [f]ile

ahrf - [a]scii (or [a]wk) [h]uman [r]eadable [f]ile ahrf is an awk script designed to interpret a simple and straightforward ASCII file format I wrote it to share my personal documentation, which is written in plain text files They can be exported to HTML The main goal was readability One requirement: awk Supporting many awk variants (nawk, mawk, gawk or OpenBSD awk) (c

References

CWE-399https://www.openssl.org/news/secadv_20140806.txthttp://secunia.com/advisories/60824http://secunia.com/advisories/60917ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.aschttp://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.aschttp://secunia.com/advisories/60938http://secunia.com/advisories/60921http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.htmlhttp://www.debian.org/security/2014/dsa-2998http://marc.info/?l=bugtraq&m=140853041709441&w=2http://marc.info/?l=bugtraq&m=141077370928502&w=2http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htmhttp://secunia.com/advisories/61775http://secunia.com/advisories/61959http://www-01.ibm.com/support/docview.wss?uid=swg21686997http://www-01.ibm.com/support/docview.wss?uid=swg21682293http://secunia.com/advisories/59756http://security.gentoo.org/glsa/glsa-201412-39.xmlhttp://marc.info/?l=bugtraq&m=142660345230545&w=2http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlhttps://kc.mcafee.com/corporate/index?page=content&id=SB10109https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.aschttps://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1127502http://www-01.ibm.com/support/docview.wss?uid=swg21683389http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240http://www.securitytracker.com/id/1030693http://www.securityfocus.com/bid/69078http://www.mandriva.com/security/advisories?name=MDVSA-2014:158http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15573.htmlhttp://secunia.com/advisories/61250http://secunia.com/advisories/61184http://secunia.com/advisories/61100http://secunia.com/advisories/61040http://secunia.com/advisories/61017http://secunia.com/advisories/60803http://secunia.com/advisories/60778http://secunia.com/advisories/60684http://secunia.com/advisories/60493http://secunia.com/advisories/60221http://secunia.com/advisories/60022http://secunia.com/advisories/59743http://secunia.com/advisories/59710http://secunia.com/advisories/59700http://secunia.com/advisories/58962http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.htmlhttp://linux.oracle.com/errata/ELSA-2014-1052.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/95161https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74https://usn.ubuntu.com/2308-1/https://nvd.nist.gov