NVD

Id
31694  
Name
CVE-2014-3509  
Description
Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-08-13  
Modified Date
2017-01-06  
Seq
2014-3509  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
166309 31694 CVE-2014-3509 NetBSD-SA2014-008  View
166310 31694 CVE-2014-3509 http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc  View
166311 31694 CVE-2014-3509 http://linux.oracle.com/errata/ELSA-2014-1052.html  View
166312 31694 CVE-2014-3509 FEDORA-2014-9301  View
166313 31694 CVE-2014-3509 FEDORA-2014-9308  View
166314 31694 CVE-2014-3509 openSUSE-SU-2014:1052  View
166315 31694 CVE-2014-3509 SSRT101818  View
166316 31694 CVE-2014-3509 SSRT101894  View
166317 31694 CVE-2014-3509 HPSBMU03267  View
166318 31694 CVE-2014-3509 SSRT101846  View
166319 31694 CVE-2014-3509 HPSBMU03304  View
166320 31694 CVE-2014-3509 HPSBMU03263  View
166321 31694 CVE-2014-3509 HPSBMU03261  View
166322 31694 CVE-2014-3509 RHSA-2015:0197  View
166323 31694 CVE-2014-3509 58962  View
166324 31694 CVE-2014-3509 59700  View
166325 31694 CVE-2014-3509 59710  View
166326 31694 CVE-2014-3509 60022  View
166327 31694 CVE-2014-3509 60221  View
166328 31694 CVE-2014-3509 60493  View
166329 31694 CVE-2014-3509 60684  View
166330 31694 CVE-2014-3509 60803  View
166331 31694 CVE-2014-3509 61017  View
166332 31694 CVE-2014-3509 61100  View
166333 31694 CVE-2014-3509 61139  View
166334 31694 CVE-2014-3509 61184  View
166335 31694 CVE-2014-3509 GLSA-201412-39  View
166336 31694 CVE-2014-3509 http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240  View
166337 31694 CVE-2014-3509 http://www-01.ibm.com/support/docview.wss?uid=swg21682293  View
166338 31694 CVE-2014-3509 http://www-01.ibm.com/support/docview.wss?uid=swg21683389  View
166339 31694 CVE-2014-3509 http://www-01.ibm.com/support/docview.wss?uid=swg21686997  View
166340 31694 CVE-2014-3509 DSA-2998  View
166341 31694 CVE-2014-3509 http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm  View
166342 31694 CVE-2014-3509 MDVSA-2014:158  View
166343 31694 CVE-2014-3509 69084  View
166344 31694 CVE-2014-3509 1030693  View
166345 31694 CVE-2014-3509 openssl-cve20143509-dos(95159)  View
166346 31694 CVE-2014-3509 https://bugzilla.redhat.com/show_bug.cgi?id=1127498  View
166347 31694 CVE-2014-3509 https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=fb0bc2b273bcc2d5401dd883fe869af4fc74bb21  View
166348 31694 CVE-2014-3509 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888  View
166349 31694 CVE-2014-3509 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380  View
166350 31694 CVE-2014-3509 [syslog-ng-announce] 20140910 syslog-ng Premium Edition 5 LTS (5.0.6a) has been released  View
166351 31694 CVE-2014-3509 https://techzone.ergon.ch/CVE-2014-3511  View
166352 31694 CVE-2014-3509 FreeBSD-SA-14:18  View
166353 31694 CVE-2014-3509 https://www.openssl.org/news/secadv_20140806.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14938 JVNDB-2014-003813 OpenSSL の t1_lib.c 内の ssl_parse_serverhello_tlsext 関数におけるサービス運用妨害 (DoS) の脆弱性 OpenSSL の t1_lib.c 内の ssl_parse_serverhello_tlsext 関数には、マルチスレッドおよびセッション再開 (session resumption）が使用されている場合、競合状態により、サービス運用妨害 (メモリの上書きおよびクライアントのアプリケーションクラッシュ) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2014-3509 70797 CVE-2014-3509 31694 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003813.html 2014-08-06 2016-10-07 View