CVE-2014-3505

Published: Aug 13, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.

Affected (59)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

59 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m
Openssl Openssl	Version 0.9.8m beta1
Openssl Openssl	Version 0.9.8n
Openssl Openssl	Version 0.9.8o
Openssl Openssl	Version 0.9.8p
Openssl Openssl	Version 0.9.8q
Openssl Openssl	Version 0.9.8r
Openssl Openssl	Version 0.9.8s
Openssl Openssl	Version 0.9.8t
Openssl Openssl	Version 0.9.8u
Openssl Openssl	Version 0.9.8v
Openssl Openssl	Version 0.9.8w
Openssl Openssl	Version 0.9.8x
Openssl Openssl	Version 0.9.8y
Openssl Openssl	Version 0.9.8za
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h

References (100)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc (unsafe URL)

Source: secalert@redhat.com

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc

Source: secalert@redhat.com

http://linux.oracle.com/errata/ELSA-2014-1052.html

Source: secalert@redhat.com

http://linux.oracle.com/errata/ELSA-2014-1053.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=140853041709441&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=141077370928502&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142660345230545&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1256.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1297.html

Source: secalert@redhat.com

http://secunia.com/advisories/58962

Source: secalert@redhat.com

http://secunia.com/advisories/59221

Source: secalert@redhat.com

http://secunia.com/advisories/59700

Source: secalert@redhat.com

http://secunia.com/advisories/59710

Source: secalert@redhat.com

http://secunia.com/advisories/59743

Source: secalert@redhat.com

http://secunia.com/advisories/59756

Source: secalert@redhat.com

http://secunia.com/advisories/60022

Source: secalert@redhat.com

http://secunia.com/advisories/60221

Source: secalert@redhat.com

http://secunia.com/advisories/60493

Source: secalert@redhat.com

http://secunia.com/advisories/60684

Source: secalert@redhat.com

http://secunia.com/advisories/60687

Source: secalert@redhat.com

http://secunia.com/advisories/60778

Source: secalert@redhat.com

http://secunia.com/advisories/60803

Source: secalert@redhat.com

http://secunia.com/advisories/60824

Source: secalert@redhat.com

http://secunia.com/advisories/60917

Source: secalert@redhat.com

http://secunia.com/advisories/60921

Source: secalert@redhat.com

http://secunia.com/advisories/60938

Source: secalert@redhat.com

http://secunia.com/advisories/61040

Source: secalert@redhat.com

http://secunia.com/advisories/61100

Source: secalert@redhat.com

http://secunia.com/advisories/61184

Source: secalert@redhat.com

http://secunia.com/advisories/61250

Source: secalert@redhat.com

http://secunia.com/advisories/61775

Source: secalert@redhat.com

http://secunia.com/advisories/61959

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201412-39.xml

Source: secalert@redhat.com

http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15573.html

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21682293

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21683389

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21686997

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-2998

Source: secalert@redhat.com

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2014:158

Source: secalert@redhat.com

http://www.securityfocus.com/bid/69081

Source: secalert@redhat.com

http://www.securitytracker.com/id/1030693

Source: secalert@redhat.com

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=bff1ce4e6a1c57c3d0a5f9e4f85ba6385fccfe8b

Source: secalert@redhat.com

https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20140806.txt

Source: secalert@redhat.com

Vendor Advisory

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc (unsafe URL)