CVE-2014-0198

Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 06 May 2014, 10:00
Last modified:06 Aug 2024, 09:05

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
32.98% HIGH
33% probability +2.09%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

06 May 2014, 10:00
Published
Vulnerability first disclosed
06 Aug 2024, 09:05
Last Modified
Vulnerability information updated

Description

The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.

CVSS Metrics

  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 32.98%• Percentile: 97%

Techniques & Countermeasures

  • CWE-476•NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

  • debian•debian_linux

    6.0 | 7.0 | 8.0

  • fedoraproject•fedora

    19 | 20

  • mariadb•mariadb

    ≥ 10.0.0, < 10.0.13

  • Unknown•OpenSSL

    ≥ 1.0.0, ≤ 1.0.1g

  • opensuse•opensuse

    12.3 | 13.1

  • suse•linux_enterprise_desktop

    12

  • suse•linux_enterprise_server

    12

  • suse•linux_enterprise_software_development_kit

    12

  • suse•linux_enterprise_workstation_extension

    12

References (112)