7.5

CVE-2014-3512

Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version 1.0.0
OpenSSL ≫ OpenSSL Version 1.0.0 Update beta1
OpenSSL ≫ OpenSSL Version 1.0.0 Update beta2
OpenSSL ≫ OpenSSL Version 1.0.0 Update beta3
OpenSSL ≫ OpenSSL Version 1.0.0 Update beta4
OpenSSL ≫ OpenSSL Version 1.0.0 Update beta5
OpenSSL ≫ OpenSSL Version 1.0.0a
OpenSSL ≫ OpenSSL Version 1.0.0b
OpenSSL ≫ OpenSSL Version 1.0.0c
OpenSSL ≫ OpenSSL Version 1.0.0d
OpenSSL ≫ OpenSSL Version 1.0.0e
OpenSSL ≫ OpenSSL Version 1.0.0f
OpenSSL ≫ OpenSSL Version 1.0.0g
OpenSSL ≫ OpenSSL Version 1.0.0h
OpenSSL ≫ OpenSSL Version 1.0.0i
OpenSSL ≫ OpenSSL Version 1.0.0j
OpenSSL ≫ OpenSSL Version 1.0.0k
OpenSSL ≫ OpenSSL Version 1.0.0l
OpenSSL ≫ OpenSSL Version 1.0.0m
OpenSSL ≫ OpenSSL Version 1.0.1
OpenSSL ≫ OpenSSL Version 1.0.1 Update beta1
OpenSSL ≫ OpenSSL Version 1.0.1 Update beta2
OpenSSL ≫ OpenSSL Version 1.0.1 Update beta3
OpenSSL ≫ OpenSSL Version 1.0.1a
OpenSSL ≫ OpenSSL Version 1.0.1b
OpenSSL ≫ OpenSSL Version 1.0.1c
OpenSSL ≫ OpenSSL Version 1.0.1d
OpenSSL ≫ OpenSSL Version 1.0.1e
OpenSSL ≫ OpenSSL Version 1.0.1f
OpenSSL ≫ OpenSSL Version 1.0.1g
OpenSSL ≫ OpenSSL Version 1.0.1h
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 74.08% 0.994
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://marc.info/?l=bugtraq&m=142660345230545&w=2
http://security.gentoo.org/glsa/glsa-201412-39.xml
http://secunia.com/advisories/61184
http://www-01.ibm.com/support/docview.wss?uid=swg21683389
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html
http://secunia.com/advisories/59700
http://secunia.com/advisories/59710
http://secunia.com/advisories/59756
http://secunia.com/advisories/60022
http://secunia.com/advisories/60221
http://secunia.com/advisories/60493
http://secunia.com/advisories/60803
http://secunia.com/advisories/60917
http://secunia.com/advisories/60921
http://secunia.com/advisories/61100
http://secunia.com/advisories/61775
http://secunia.com/advisories/61959
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240
http://www-01.ibm.com/support/docview.wss?uid=swg21682293
http://www-01.ibm.com/support/docview.wss?uid=swg21686997
http://www.debian.org/security/2014/dsa-2998
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm
http://www.securitytracker.com/id/1030693
https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html
https://www.openssl.org/news/secadv_20140806.txt
Vendor Advisory
http://secunia.com/advisories/61017
https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc
http://secunia.com/advisories/61171
http://www.tenable.com/security/tns-2014-06
http://secunia.com/advisories/60810
http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15565.html
http://www.securityfocus.com/bid/69083
https://exchange.xforce.ibmcloud.com/vulnerabilities/95158
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=4a23b12a031860253b58d503f296377ca076427b