Skip to content
OpenAdvisories
Medium ELSA-2014-1052 7 CVEs

Moderate: openssl security update (Oracle Linux 7)

Published Aug 13, 2014 · Updated Aug 13, 2014

Ecosystem: Oracle Linux

Summary

[1.0.1e-34.4]
- fix CVE-2014-3505 - doublefree in DTLS packet processing
- fix CVE-2014-3506 - avoid memory exhaustion in DTLS
- fix CVE-2014-3507 - avoid memory leak in DTLS
- fix CVE-2014-3508 - fix OID handling to avoid information leak
- fix CVE-2014-3509 - fix race condition when parsing server hello
- fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
- fix CVE-2014-3511 - disallow protocol downgrade via fragmentation

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 openssl 1:1.0.1e-34.el7_0.4
Oracle Linux · 7 openssl-devel 1:1.0.1e-34.el7_0.4
Oracle Linux · 7 openssl-libs 1:1.0.1e-34.el7_0.4
Oracle Linux · 7 openssl-perl 1:1.0.1e-34.el7_0.4
Oracle Linux · 7 openssl-static 1:1.0.1e-34.el7_0.4

Vulnerabilities 7

  • Unscored —
    CVE-2014-3505 EPSS 46%

    Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n,…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3506 EPSS 46%

    d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allo…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3507 Public exploit EPSS 55%

    Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 bef…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3508 EPSS 25%

    The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 be…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3509 EPSS 13%

    Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3510 EPSS 18%

    The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1…

    openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2014-3511 EPSS 14%

    The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to …

    openssl openssl Debian Ubuntu