CVE-2014-0198

Исходное описание

The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.

Затронутое ПО

• OpenSSL ≥ 1.0.0 ≤ 1.0.1g точное совпадение
• MariaDB ≥ 10.0.0 < 10.0.13 Исправлено в: 10.0.13 точное совпадение

Подробности

Опубликовано

2014-05-06

Последнее изменение

2026-06-17

Вектор CVSS

AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE

CWE-476

Ссылки

• cve.org/CVE-2014-0198
• nvd.nist.gov/vuln/detail/CVE-2014-0198
• advisories.mageia.org/MGASA-2014-0204.html
• aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc
• kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
• kb.juniper.net/InfoCenter/index?page=content&id=KB29195
• lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
• lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
• lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
• lists.opensuse.org/opensuse-updates/2014-05/msg00036.html
• lists.opensuse.org/opensuse-updates/2014-05/msg00037.html
• marc.info/?l=bugtraq&m=140389274407904&w=2
• marc.info/?l=bugtraq&m=140389355508263&w=2
• marc.info/?l=bugtraq&m=140431828824371&w=2