QwikSec

Security Database

CVE

CWE

Training

CVE-2014-8176

Published: Jun 12, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10122

http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015

https://openssl.org/news/secadv/20150611.txt

vendor-advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351

vdb-entry

20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products

vendor-advisory

openSUSE-SU-2015:1277

vendor-advisory

vdb-entry

vendor-advisory

http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015

https://github.com/openssl/openssl/commit/470990fee0182566d439ef7e82d1abf18b7085d7

vendor-advisory

https://rt.openssl.org/Ticket/Display.html?id=3286&user=guest&pass=guest

vendor-advisory

SUSE-SU-2015:1185

vendor-advisory

https://bto.bluecoat.com/security-advisory/sa98

NetBSD-SA2015-008

vendor-advisory

https://www.openssl.org/news/secadv_20150611.txt

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.