CVE-2014-3508

Description

The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

2.698

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2014-3510,CVE-2014-3508,CVE-2014-3507,CVE-2014-3506,CVE-2014-3505 are fixed in OpenSSL (x64) 0.9.8zb	Windows
Multiple vulnerabilities fixed in OpenSSL (x64) 1.0.0n	Windows
Multiple vulnerabilities fixed in OpenSSL (x64) 1.0.1i	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.1	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2	Windows
Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-3508)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234