CVE-2014-3510

Description

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.

Risk Information

Base Score

9.1

MODERATE

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Score

Exploitation Probability

13.682

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2014-3510,CVE-2014-3508,CVE-2014-3507,CVE-2014-3506,CVE-2014-3505 are fixed in OpenSSL (x64) 0.9.8zb	Windows
Multiple vulnerabilities fixed in OpenSSL (x64) 1.0.0n	Windows
Multiple vulnerabilities fixed in OpenSSL (x64) 1.0.1i	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.1	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2	Windows
CVE-2014-3510	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234