CVE-2014-3512: openssl

Modified

AliasesUBUNTU-CVE-2014-3512DEBIAN-CVE-2014-3512

Published 13-08-2014Last modified 06-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2014-3512 is a high (CVSS 7.5) vulnerability in openssl. EPSS estimates a 74.08% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

74.08%

0%100%

Critical · +5.10 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 3

DSA-2998-1 MGASA-2014-0325 OPENSUSE-SU-2024:10309-1 OPENSUSE-SU-2024:11127-1 USN-2308-1

Timeline

13-08-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

74.08%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

Increase +5.10 pp

From 68.98% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

openssl< 1.0.1i-1

Openssl1 product

opensslEOL1.0.0 | 1.0.0:beta1 | 1.0.0:beta2 | 1.0.0:beta3 | 1.0.0:beta4 | 1.0.0:beta5 | 1.0.0a | 1.0.0b | 1.0.0c | 1.0.0d | 1.0.0e | 1.0.0f | 1.0.0g | 1.0.0h | 1.0.0i | 1.0.0j | 1.0.0k | 1.0.0l | 1.0.0m | 1.0.1 | 1.0.1:beta1 | 1.0.1:beta2 | 1.0.1:beta3 | 1.0.1a | 1.0.1b | 1.0.1c | 1.0.1d | 1.0.1e | 1.0.1f | 1.0.1g | 1.0.1h

Ubuntu1 product

openssl< 1.0.1f-1ubuntu2.5

3 vendors · 3 products

References

39 links

lists.opensuse.org/opensuse-updates/2014-08/msg00036.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/60221Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21682293X Refsource CONFIRM
secunia.com/advisories/61184Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=142660345230545&w=2Vendor AdvisoryX Refsource HP
secunia.com/advisories/60022Third Party AdvisoryX Refsource SECUNIA
support.f5.com/kb/en-us/solutions/public/15000/500/sol15565.htmlX Refsource CONFIRM
www.openssl.org/news/secadv_20140806.txtX Refsource CONFIRMVendor AdvisoryREPORT
secunia.com/advisories/61017Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/95158VDB EntryX Refsource XF

Show all 39 references

www-01.ibm.com/support/docview.wss?uid=swg21683389X Refsource CONFIRM
www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htmX Refsource CONFIRM
git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=4a23b12a031860253b58d503f296377ca076427bX Refsource CONFIRM
security.gentoo.org/glsa/glsa-201412-39.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/60803Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59700Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id/1030693VDB EntryX Refsource SECTRACK
secunia.com/advisories/60917Third Party AdvisoryX Refsource SECUNIA
www.tenable.com/security/tns-2014-06X Refsource CONFIRM
secunia.com/advisories/60493Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59710Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/60921Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/60810Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/69083VDB EntryX Refsource BID
www-01.ibm.com/support/docview.wss?uid=nas8N1020240X Refsource CONFIRM
secunia.com/advisories/61100Third Party AdvisoryX Refsource SECUNIA
www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.ascVendor AdvisoryX Refsource FREEBSD
secunia.com/advisories/61775Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2014/dsa-2998Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/61959Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59756Third Party AdvisoryX Refsource SECUNIA
aix.software.ibm.com/aix/efixes/security/openssl_advisory10.ascX Refsource CONFIRM
lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.htmlMailing ListX Refsource MLIST
secunia.com/advisories/61171Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21686997X Refsource CONFIRM
ubuntu.com/security/CVE-2014-3512REPORT
ubuntu.com/security/notices/USN-2308-1Advisory
www.cve.org/CVERecord?id=CVE-2014-3512REPORT
security-tracker.debian.org/tracker/CVE-2014-3512Advisory