CVE-2014-0198

The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer…

published May 6, 2014

CVSS
—
EPSS
40%
Percentile
98.6
In the wild
Unconfirmed
What it is

The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.40310 · 98.6th percentile
Published
2014-05-06T10:00Z
EPSS history
Timeline
  • 06 MAY 10:00Z
    The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer…
    cvelistv5