CVE-2014-3509

Description

Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.

Risk Information

Base Score

8.1

MODERATE

Vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

11.435

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities fixed in OpenSSL (x64) 1.0.0n	Windows
Multiple vulnerabilities fixed in OpenSSL (x64) 1.0.1i	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.1	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2	Windows
Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) Vulnerability (CVE-2014-3509)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234