Lucene search

Veracode Vulnerability DatabaseVERACODE:3473

HistoryFeb 07, 2017 - 1:07 a.m.

Denial Of Service (DoS) Through Memory Overwrite

2017-02-0701:07:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.024 Low

EPSS

Percentile

90.0%

JSON

OepnSSL is vulnerable to denial of service (DoS) attacks through memory overwrite and client application crash. If a multithreaded client connects to a malicious server using a resumed session, it is possible to trigger a race condition in the ssl_parse_serverhello_tlsext function which allows an attacker to write up to 255 bytes of freed memory.

CPENameOperatorVersion
opensslle1.0.108
openssleq1.0.0__4.el6_0.2
openssleq1.0.0__10.el6_1.5
openssleq1.0.0__25.el6_3.1
openssleq1.0.0__20.el6_2.1
openssleq1.0.0__4.el6_0.1
openssleq1.0.0__27.el6
openssleq1.0.0__20.el6_2.3
openssleq1.0.0__10.el6_1.4
openssleq1.0.0__20.el6_2.4

Name	Operator	Version
openssl	le	1.0.108
openssl	eq	1.0.0__4.el6_0.2
openssl	eq	1.0.0__10.el6_1.5
openssl	eq	1.0.0__25.el6_3.1
openssl	eq	1.0.0__20.el6_2.1
openssl	eq	1.0.0__4.el6_0.1
openssl	eq	1.0.0__27.el6
openssl	eq	1.0.0__20.el6_2.3
openssl	eq	1.0.0__10.el6_1.4
openssl	eq	1.0.0__20.el6_2.4

Rows per page:

1-10 of 171

References

aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc

linux.oracle.com/errata/ELSA-2014-1052.html

lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html

lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

lists.opensuse.org/opensuse-updates/2014-08/msg00036.html

marc.info/?l=bugtraq&m=142350350616251&w=2

marc.info/?l=bugtraq&m=142495837901899&w=2

marc.info/?l=bugtraq&m=142624590206005&w=2

marc.info/?l=bugtraq&m=142660345230545&w=2

marc.info/?l=bugtraq&m=142791032306609&w=2

marc.info/?l=bugtraq&m=143290437727362&w=2

marc.info/?l=bugtraq&m=143290522027658&w=2

rhn.redhat.com/errata/RHSA-2015-0197.html

secunia.com/advisories/58962

secunia.com/advisories/59700

secunia.com/advisories/59710

secunia.com/advisories/59756

secunia.com/advisories/60022

secunia.com/advisories/60221

secunia.com/advisories/60493

secunia.com/advisories/60684

secunia.com/advisories/60803

secunia.com/advisories/60917

secunia.com/advisories/60921

secunia.com/advisories/60938

secunia.com/advisories/61017

secunia.com/advisories/61100

secunia.com/advisories/61139

secunia.com/advisories/61184

secunia.com/advisories/61775

secunia.com/advisories/61959

security.gentoo.org/glsa/glsa-201412-39.xml

www-01.ibm.com/support/docview.wss?uid=nas8N1020240

www-01.ibm.com/support/docview.wss?uid=swg21682293

www-01.ibm.com/support/docview.wss?uid=swg21683389

www-01.ibm.com/support/docview.wss?uid=swg21686997

www.debian.org/security/2014/dsa-2998

www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm

www.mandriva.com/security/advisories?name=MDVSA-2014:158

www.securityfocus.com/bid/69084

www.securitytracker.com/id/1030693

bugzilla.redhat.com/show_bug.cgi?id=1127498

exchange.xforce.ibmcloud.com/vulnerabilities/95159

git.openssl.org/gitweb/?p=openssl.git;a=commit;h=fb0bc2b273bcc2d5401dd883fe869af4fc74bb21

h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html

support.citrix.com/article/CTX216642

techzone.ergon.ch/CVE-2014-3511

www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc

www.openssl.org/news/secadv/20140806.txt

www.openssl.org/news/secadv_20140806.txt