CVE-2014-3509
medium · 6.8Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.
6.8
CVSS
13.4%
EPSS (exploit prob.)
96th
EPSS percentile
2014-08-13
Published
AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-362
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| openssl | openssl | 1.0.0 |
| openssl | openssl | 1.0.0 |
| openssl | openssl | 1.0.0 |
| openssl | openssl | 1.0.0 |
| openssl | openssl | 1.0.0 |
| openssl | openssl | 1.0.0 |
| openssl | openssl | 1.0.0a |
| openssl | openssl | 1.0.0b |
| openssl | openssl | 1.0.0c |
| openssl | openssl | 1.0.0d |
| openssl | openssl | 1.0.0e |
| openssl | openssl | 1.0.0f |
| openssl | openssl | 1.0.0g |
| openssl | openssl | 1.0.0h |
| openssl | openssl | 1.0.0i |
| openssl | openssl | 1.0.0j |
| openssl | openssl | 1.0.0k |
| openssl | openssl | 1.0.0l |
| openssl | openssl | 1.0.0m |
| openssl | openssl | 1.0.1 |
| openssl | openssl | 1.0.1 |
| openssl | openssl | 1.0.1 |
| openssl | openssl | 1.0.1 |
| openssl | openssl | 1.0.1a |
| openssl | openssl | 1.0.1b |
| openssl | openssl | 1.0.1c |
| openssl | openssl | 1.0.1d |
| openssl | openssl | 1.0.1e |
| openssl | openssl | 1.0.1f |
| openssl | openssl | 1.0.1g |
| openssl | openssl | 1.0.1h |
Check a specific version with /api/v1/cve/match.
References
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
- http://linux.oracle.com/errata/ELSA-2014-1052.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html
- http://marc.info/?l=bugtraq&m=142350350616251&w=2
- http://marc.info/?l=bugtraq&m=142495837901899&w=2
- http://marc.info/?l=bugtraq&m=142624590206005&w=2
- http://marc.info/?l=bugtraq&m=142660345230545&w=2
- http://marc.info/?l=bugtraq&m=142791032306609&w=2
- http://marc.info/?l=bugtraq&m=143290437727362&w=2
- http://marc.info/?l=bugtraq&m=143290522027658&w=2
- http://rhn.redhat.com/errata/RHSA-2015-0197.html
- http://secunia.com/advisories/58962
- http://secunia.com/advisories/59700
- http://secunia.com/advisories/59710
- http://secunia.com/advisories/59756
- http://secunia.com/advisories/60022
- http://secunia.com/advisories/60221
- http://secunia.com/advisories/60493
- http://secunia.com/advisories/60684
- http://secunia.com/advisories/60803
- http://secunia.com/advisories/60917
- http://secunia.com/advisories/60921
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-3509