CVE-2014-0198

Published: May 6, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.

Affected (13)

Products: Openssl: Openssl · Mariadb: Mariadb · Fedoraproject: Fedora · +3 more

Show all products

Openssl: Openssl · Mariadb: Mariadb · Fedoraproject: Fedora · Debian: Debian Linux · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit, Linux Enterprise Workstation Extension

1 product

1 product

1 product

1 product

1 product

4 products

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

Linux Enterprise Workstation Extension

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	From 1.0.0 to 1.0.1g

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Mariadb Mariadb	From 10.0.0 to 10.0.13

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 19
Fedoraproject Fedora	Version 20

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 6.0
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration E

6 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 12.3
Opensuse Opensuse	Version 13.1
Suse Linux Enterprise Desktop	Version 12
Suse Linux Enterprise Server	Version 12
Suse Linux Enterprise Software Development Kit	Version 12
Suse Linux Enterprise Workstation Extension	Version 12

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (224)

http://advisories.mageia.org/MGASA-2014-0204.html

Source: secalert@redhat.com

Third Party Advisory

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc

Source: secalert@redhat.com

Third Party Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629

Source: secalert@redhat.com

Third Party Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2014-05/msg00036.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2014-05/msg00037.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140389274407904&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140389355508263&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140431828824371&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140448122410568&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140544599631400&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140621259019789&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140752315422991&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140904544427729&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=141658880509699&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://puppetlabs.com/security/cve/cve-2014-0198

Source: secalert@redhat.com

Third Party Advisory

http://seclists.org/fulldisclosure/2014/Dec/23

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/58337

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/58667

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/58713

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/58714

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/58939

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/58945

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/58977

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59126

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59162

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59163

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59190

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59202

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59264

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59282

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59284

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59287

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59300

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59301

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59306

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59310

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59342

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59374

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59398

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59413

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59437

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59438

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59440

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59449

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59450

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59490

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59491

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59514

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59525

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59529

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59655

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59666

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59669

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59721

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59784

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/59990

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/60049

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/60066

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/60571

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/61254

Source: secalert@redhat.com

Not Applicable

http://security.gentoo.org/glsa/glsa-201407-05.xml

Source: secalert@redhat.com

Third Party Advisory

http://support.citrix.com/article/CTX140876

Source: secalert@redhat.com

Third Party Advisory

http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15329.html

Source: secalert@redhat.com

Third Party Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21673137

Source: secalert@redhat.com

Broken Link

http://www-01.ibm.com/support/docview.wss?uid=swg21676035

Source: secalert@redhat.com

Broken Link

http://www-01.ibm.com/support/docview.wss?uid=swg21676062

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21676419

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21676529

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21676655

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21676879

Source: secalert@redhat.com

Broken Link

http://www-01.ibm.com/support/docview.wss?uid=swg21676889

Source: secalert@redhat.com

Broken Link

http://www-01.ibm.com/support/docview.wss?uid=swg21677527

Source: secalert@redhat.com

Broken Link

http://www-01.ibm.com/support/docview.wss?uid=swg21677695

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21677828

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21677836

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21678167

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21683332

Source: secalert@redhat.com

Third Party Advisory

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754

Source: secalert@redhat.com

Broken Link

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755

Source: secalert@redhat.com

Broken Link

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756

Source: secalert@redhat.com

Broken Link

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757

Source: secalert@redhat.com

Broken Link

http://www.blackberry.com/btsc/KB36051

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2014/dsa-2931

Source: secalert@redhat.com

Third Party Advisory

http://www.fortiguard.com/advisory/FG-IR-14-018/

Source: secalert@redhat.com

Third Party Advisory

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm

Source: secalert@redhat.com

Third Party Advisory

http://www.ibm.com/support/docview.wss?uid=swg21676356

Source: secalert@redhat.com

Third Party Advisory

http://www.ibm.com/support/docview.wss?uid=swg24037783

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2014:080

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2015:062

Source: secalert@redhat.com

Broken Link

http://www.openbsd.org/errata55.html#005_openssl

Source: secalert@redhat.com

Third Party Advisory

http://www.openssl.org/news/secadv_20140605.txt

Source: secalert@redhat.com

Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/67193

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.vmware.com/security/advisories/VMSA-2014-0006.html

Source: secalert@redhat.com

Third Party Advisory

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1093837

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946

Source: secalert@redhat.com

Third Party Advisory

https://kb.bluecoat.com/index?page=content&id=SA80

Source: secalert@redhat.com

Broken Link

https://kc.mcafee.com/corporate/index?page=content&id=SB10075

Source: secalert@redhat.com

Broken Link

https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321

Source: secalert@redhat.com

Broken Link

https://www.novell.com/support/kb/doc.php?id=7015271

Source: secalert@redhat.com

Third Party Advisory

http://advisories.mageia.org/MGASA-2014-0204.html