A race condition was found in ssl_parse_serverhello_tlsext. If a multithreaded client connects to a malicious server using a resumed session and the server sends an ec point format extension, it could write up to 255 bytes to freed memory.

Found by Gabor Tyukasz (LogMeIn Inc).

Affected configurations

Vulners

Node

opensslopensslRange1.0.1–1.0.1i

opensslopensslRange1.0.0–1.0.0n

VendorProductVersionCPE
opensslopenssl*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openssl	openssl	*	cpe:2.3:a:openssl:openssl::::::::

openvas 22

nvd 1

debiancve 1

prion 1

f5 2

veracode 1

ubuntucve 1

cvelist 1

cve 1

ibm 34

nessus 34

redhat 3

centos 1

oraclelinux 6

freebsd_advisory 1

ubuntu 1

huawei 1

osv 3

debian 1

kaspersky 1

securityvulns 2

aix 1

mageia 1

freebsd 1

amazon 1

slackware 1

fedora 8

altlinux 5

gentoo 1

openvas

OpenSSL DoS Vulnerability (20140806) - Linux

2021-07-19 00:00:00

OpenSSL DoS Vulnerability (20140806) - Windows

2021-07-19 00:00:00

Oracle: Security Advisory (ELSA-2014-1052)

2015-10-06 00:00:00

nvd

CVE-2014-3509

2014-08-13 23:55:07

debiancve

CVE-2014-3509

2014-08-13 23:55:07

prion

Race condition

2014-08-13 23:55:00

K15541 : OpenSSL vulnerability CVE-2014-3509

2014-09-12 00:00:00

SOL15541 - OpenSSL vulnerability CVE-2014-3509

2014-09-05 00:00:00

veracode

Denial Of Service (DoS) Through Memory Overwrite

2017-02-07 01:07:14

ubuntucve

CVE-2014-3509

2014-08-07 00:00:00

cvelist

CVE-2014-3509

2014-08-13 23:00:00

cve

CVE-2014-3509

2014-08-13 23:55:07

ibm

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Systems Director (CVE-2014-3509, CVE-2014-3511)

2022-08-23 16:46:40

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Worklight (CVE-2014-3509, CVE-2014-5139)

2018-06-17 22:31:20

Security Bulletin: Vulnerabilities in OpenSSL (CVE-2014-3508 and CVE-2014-3509) affect the virtual machines deployed by IBM Workload Deployer.

2018-06-15 07:02:21

nessus

RHEL 6 : rhevm-spice-client (RHSA-2015:0197)

2015-09-01 00:00:00

Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10649)

2014-10-14 00:00:00

Mandriva Linux Security Advisory : openssl (MDVSA-2014:158)

2014-08-09 00:00:00

redhat

(RHSA-2015:0197) Moderate: rhevm-spice-client security and bug fix update

2014-07-25 00:00:00

(RHSA-2014:1054) Moderate: openssl security update

2014-08-14 00:00:00

(RHSA-2014:1052) Moderate: openssl security update

2014-08-13 00:00:00

centos

openssl security update

2014-08-13 20:10:43

oraclelinux

openssl security update

2014-08-13 00:00:00

openssl security update

2014-10-16 00:00:00

openssl security update

2016-09-27 00:00:00

freebsd_advisory

FreeBSD-SA-14:18.openssl

2014-09-09 00:00:00

ubuntu

OpenSSL vulnerabilities

2014-08-07 00:00:00

huawei

Security Advisory-9 OpenSSL vulnerabilities on Huawei products

2014-10-08 00:00:00

osv

openssl - security update

2014-08-07 00:00:00

libcrypto38-2.5.0-1.1 on GA media

2024-06-15 00:00:00

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

2024-06-15 00:00:00

debian

[SECURITY] [DSA 2998-1] openssl security update

2014-08-06 23:44:13

kaspersky

KLA10343 Multiple vulnerabilities in Stunnel

2014-08-07 00:00:00

securityvulns

OpenSSL multiple security vulnerabilities

2014-08-07 00:00:00

ESA-2015-002: Unisphere Central Security Update for Multiple Vulnerabilities

2015-02-02 00:00:00

aix

AIX OpenSSL Denial of Service due to double free and others

2014-09-09 00:50:00

mageia

Updated openssl packages fix security vulnerabilities

2014-08-12 13:16:46

freebsd

OpenSSL -- multiple vulnerabilities

2014-08-06 00:00:00

amazon

Medium: openssl

2014-08-07 12:26:00

slackware

[slackware-security] openssl

2014-08-08 21:22:00

fedora

[SECURITY] Fedora 21 Update: mingw-openssl-1.0.1j-1.fc21

2015-01-02 05:06:53

[SECURITY] Fedora 20 Update: openssl-1.0.1e-39.fc20

2014-08-09 07:36:05

[SECURITY] Fedora 19 Update: openssl-1.0.1e-39.fc19

2014-08-09 07:34:58

altlinux

Security fix for the ALT Linux 9 package openssl1.1 version 1.0.1j-alt1

2014-10-30 00:00:00

Security fix for the ALT Linux 9 package openssl10 version 1.0.1j-alt1

2014-10-30 00:00:00

Security fix for the ALT Linux 7 package openssl10 version 1.0.1j-alt1

2014-10-30 00:00:00

gentoo

OpenSSL: Multiple vulnerabilities

2014-12-26 00:00:00

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

5.7

Confidence

Low

EPSS

0.024

Percentile

90.0%

JSON

Related for OPENSSL:CVE-2014-3509