NVD

Id
35374  
Name
CVE-2014-8176  
Description
The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-06-12  
Modified Date
2016-12-30  
Seq
2014-8176  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
181348 35374 CVE-2014-8176 http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015  View
181349 35374 CVE-2014-8176 NetBSD-SA2015-008  View
181350 35374 CVE-2014-8176 SUSE-SU-2015:1185  View
181351 35374 CVE-2014-8176 openSUSE-SU-2015:1277  View
181352 35374 CVE-2014-8176 RHSA-2015:1115  View
181353 35374 CVE-2014-8176 20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products  View
181354 35374 CVE-2014-8176 DSA-3287  View
181355 35374 CVE-2014-8176 http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015  View
181356 35374 CVE-2014-8176 75159  View
181357 35374 CVE-2014-8176 1032564  View
181358 35374 CVE-2014-8176 USN-2639-1  View
181359 35374 CVE-2014-8176 https://bto.bluecoat.com/security-advisory/sa98  View
181360 35374 CVE-2014-8176 https://github.com/openssl/openssl/commit/470990fee0182566d439ef7e82d1abf18b7085d7  View
181361 35374 CVE-2014-8176 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351  View
181362 35374 CVE-2014-8176 https://kc.mcafee.com/corporate/index?page=content&id=SB10122  View
181363 35374 CVE-2014-8176 https://openssl.org/news/secadv/20150611.txt  View
181364 35374 CVE-2014-8176 https://rt.openssl.org/Ticket/Display.html?id=3286&user=guest&pass=guest  View
181365 35374 CVE-2014-8176 GLSA-201506-02  View
181366 35374 CVE-2014-8176 https://www.openssl.org/news/secadv_20150611.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19207 JVNDB-2014-008084 OpenSSL の ssl/d1_lib.c の dtls1_clear_queues 関数におけるサービス運用妨害 (DoS) の脆弱性 OpenSSL の ssl/d1_lib.c の dtls1_clear_queues 関数は、ChangeCipherSpec メッセージと Finished メッセージとの間で到着可能なアプリケーションのデータを考慮することなしに、データ構造を解放するため、サービス運用妨害 (メモリ破損およびアプリケーションクラッシュ) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2014-8176 75469 CVE-2014-8176 35374 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008084.html 2014-06-03 2016-10-07 View