CVEvulnerability

CVE-2014-3470

4.3 MEDIUM Published 2014-06-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-06-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-476

Description

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

Affected configurations

• openssl openssl (< 0.9.8za) • openssl openssl (>= 1.0.0 < 1.0.0m) • openssl openssl (>= 1.0.1 < 1.0.1h) • redhat storage 2.1 • fedoraproject fedora • redhat enterprise linux 5 • redhat enterprise linux 6.0 • mariadb mariadb (>= 10.0.0 < 10.0.13) • fedoraproject fedora 19 • fedoraproject fedora 20 • opensuse leap 42.1 • opensuse opensuse 13.2 • suse linux enterprise desktop 12 • suse linux enterprise server 12 • suse linux enterprise software development kit 12 • suse linux enterprise workstation extension 12

Related

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References