CVEvulnerability
CVE-2014-2896
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-01-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-125
Description
The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read.
Affected configurations
• wolfssl wolfssl (>= 2.5.0 < 2.9.4)
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- http://seclists.org/oss-sec/2014/q2/126 Mailing List, Third Party Advisory
- http://seclists.org/oss-sec/2014/q2/130 Mailing List, Third Party Advisory
- http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html Vendor Advisory
- http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html Vendor Advisory
- http://seclists.org/oss-sec/2014/q2/126 Mailing List, Third Party Advisory
- http://seclists.org/oss-sec/2014/q2/130 Mailing List, Third Party Advisory
- http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html Vendor Advisory
- http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html Vendor Advisory