FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2014-0198

This CVE name corresponds to:

Entered	Topic
2014-05-03	OpenSSL -- NULL pointer dereference / DoS

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2014-0198 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2014-0198
Phase	Assigned(20131203)

Description

The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.

References

Source	Reference
BUGTRAQ	20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
FULLDISC	20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=1093837
CONFIRM	https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321
CONFIRM	http://www.openssl.org/news/secadv_20140605.txt
CONFIRM	https://kb.bluecoat.com/index?page=content&id=SA80
CONFIRM	http://www-01.ibm.com/support/docview.wss?uid=swg21676035
CONFIRM	http://www-01.ibm.com/support/docview.wss?uid=swg21676062
CONFIRM	http://www-01.ibm.com/support/docview.wss?uid=swg21676419
CONFIRM	http://www-01.ibm.com/support/docview.wss?uid=swg21676655
CONFIRM	http://www.blackberry.com/btsc/KB36051
CONFIRM	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm
CONFIRM	https://kc.mcafee.com/corporate/index?page=content&id=SB10075
CONFIRM	http://www-01.ibm.com/support/docview.wss?uid=swg21673137
CONFIRM	http://www-01.ibm.com/support/docview.wss?uid=swg21677828
CONFIRM	http://www-01.ibm.com/support/docview.wss?uid=swg21677527
CONFIRM	http://www-01.ibm.com/support/docview.wss?uid=swg21677695
CONFIRM	http://www-01.ibm.com/support/docview.wss?uid=swg21678167
CONFIRM	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM	http://www.fortiguard.com/advisory/FG-IR-14-018/
CONFIRM	http://puppetlabs.com/security/cve/cve-2014-0198
CONFIRM	http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CISCO	20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products
DEBIAN	DSA-2931
MANDRIVA	MDVSA-2015:062
OPENBSD	[5.5] 005: RELIABILITY FIX: May 1, 2014
SUSE	openSUSE-SU-2014:0634
SUSE	openSUSE-SU-2014:0635
SECUNIA	58939
SECUNIA	59126
SECUNIA	59162
SECUNIA	59300
SECUNIA	59438
SECUNIA	59450
SECUNIA	59491
SECUNIA	59514
SECUNIA	59490
SECUNIA	59655
SECUNIA	59721
SECUNIA	59413
SECUNIA	59669
SECUNIA	59301
SECUNIA	59666
SECUNIA	59342
SECUNIA	60049
SECUNIA	60066
SECUNIA	59784
SECUNIA	59990
SECUNIA	60571