CVE-2014-3507

Published: Aug 13, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.

Affected (59)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

59 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m
Openssl Openssl	Version 0.9.8m beta1
Openssl Openssl	Version 0.9.8n
Openssl Openssl	Version 0.9.8o
Openssl Openssl	Version 0.9.8p
Openssl Openssl	Version 0.9.8q
Openssl Openssl	Version 0.9.8r
Openssl Openssl	Version 0.9.8s
Openssl Openssl	Version 0.9.8t
Openssl Openssl	Version 0.9.8u
Openssl Openssl	Version 0.9.8v
Openssl Openssl	Version 0.9.8w
Openssl Openssl	Version 0.9.8x
Openssl Openssl	Version 0.9.8y
Openssl Openssl	Version 0.9.8za
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h

Related CWEs

CWE-399

References (100)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc (unsafe URL)

Source: secalert@redhat.com

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc

Source: secalert@redhat.com

http://linux.oracle.com/errata/ELSA-2014-1052.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=140853041709441&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=141077370928502&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142660345230545&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/58962

Source: secalert@redhat.com

http://secunia.com/advisories/59700

Source: secalert@redhat.com

http://secunia.com/advisories/59710

Source: secalert@redhat.com

http://secunia.com/advisories/59743

Source: secalert@redhat.com

http://secunia.com/advisories/59756

Source: secalert@redhat.com

http://secunia.com/advisories/60022

Source: secalert@redhat.com

http://secunia.com/advisories/60221

Source: secalert@redhat.com

http://secunia.com/advisories/60493

Source: secalert@redhat.com

http://secunia.com/advisories/60684

Source: secalert@redhat.com

http://secunia.com/advisories/60778

Source: secalert@redhat.com

http://secunia.com/advisories/60803

Source: secalert@redhat.com

http://secunia.com/advisories/60824

Source: secalert@redhat.com

http://secunia.com/advisories/60917

Source: secalert@redhat.com

http://secunia.com/advisories/60921

Source: secalert@redhat.com

http://secunia.com/advisories/60938

Source: secalert@redhat.com

http://secunia.com/advisories/61017

Source: secalert@redhat.com

http://secunia.com/advisories/61040

Source: secalert@redhat.com

http://secunia.com/advisories/61100

Source: secalert@redhat.com

http://secunia.com/advisories/61184

Source: secalert@redhat.com

http://secunia.com/advisories/61250

Source: secalert@redhat.com

http://secunia.com/advisories/61775

Source: secalert@redhat.com

http://secunia.com/advisories/61959

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201412-39.xml

Source: secalert@redhat.com

http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15573.html

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21682293

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21683389

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21686997

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-2998

Source: secalert@redhat.com

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2014:158

Source: secalert@redhat.com

http://www.securityfocus.com/bid/69078

Source: secalert@redhat.com

http://www.securitytracker.com/id/1030693

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1127502

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/95161

Source: secalert@redhat.com

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10109

Source: secalert@redhat.com

https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html

Source: secalert@redhat.com

https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20140806.txt

Source: secalert@redhat.com

Vendor Advisory

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc (unsafe URL)