CVE-2014-3507

medium · 5

Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.

CVSS

54.3%

EPSS (exploit prob.)

99th

EPSS percentile

2014-08-13

Published

AV:N/AC:L/Au:N/C:N/I:N/A:P

Weaknesses

CWE-399

Affected products

Vendor	Product	Affected versions
openssl	openssl	0.9.8
openssl	openssl	0.9.8a
openssl	openssl	0.9.8b
openssl	openssl	0.9.8c
openssl	openssl	0.9.8d
openssl	openssl	0.9.8e
openssl	openssl	0.9.8f
openssl	openssl	0.9.8g
openssl	openssl	0.9.8h
openssl	openssl	0.9.8i
openssl	openssl	0.9.8j
openssl	openssl	0.9.8k
openssl	openssl	0.9.8l
openssl	openssl	0.9.8m
openssl	openssl	0.9.8m
openssl	openssl	0.9.8n
openssl	openssl	0.9.8o
openssl	openssl	0.9.8p
openssl	openssl	0.9.8q
openssl	openssl	0.9.8r
openssl	openssl	0.9.8s
openssl	openssl	0.9.8t
openssl	openssl	0.9.8u
openssl	openssl	0.9.8v
openssl	openssl	0.9.8w
openssl	openssl	0.9.8x
openssl	openssl	0.9.8y
openssl	openssl	0.9.8za
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0a
openssl	openssl	1.0.0b
openssl	openssl	1.0.0c
openssl	openssl	1.0.0d
openssl	openssl	1.0.0e
openssl	openssl	1.0.0f

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3507