Description
The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.1g-4 | — |
| Debian 13 | openssl | 1.0.1g-4 | — |
| Debian 12 | openssl | 1.0.1g-4 | — |
| Debian 7 | openssl | 1.0.1e-2+deb7u9 | DSA-2931-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.1 | USN-2192-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssl +4 | 1:1.0.1e-34.el7_0.3 | RHSA-2014:0679 |
| RHEL 6 | openssl +3 | 1.0.1e-16.el6_5.14 | RHSA-2014:0625 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 2 | openssl +3 | 1.0.1e-16.el6_5.14 | RHSA-2014:0628 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | mariadb | 10.0.16-15.1 | SUSE-SU-2015:0743-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | mariadb | 10.0.16-15.1 | SUSE-SU-2015:0743-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | openssl +4 | 1:1.0.1e-34.el7_0.3 | ELSA-2014-0679 |
Advisories 9
- RHSA-2014:0679 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0625 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0628 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-2192-1 openssl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-2931-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2015:0743-1 Security update for mariadb SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-0501 OpenSSL: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Feb 27, 2023
- ELSA-2014-0679 Important: openssl security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2014
References
- 59342 third-party-advisory
- 59669 third-party-advisory
- 59525 third-party-advisory
- 59282 third-party-advisory
- 59990 third-party-advisory
- 59264 third-party-advisory
- http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15329.html
- 59126 third-party-advisory
- 67193 vdb-entry
- 59306 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1093837
- HPSBGN03068 vendor-advisory
- 59190 third-party-advisory
- 59529 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- 61254 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21676655
- http://puppetlabs.com/security/cve/cve-2014-0198
- 59449 third-party-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946
- http://www-01.ibm.com/support/docview.wss?uid=swg21676879
- http://www-01.ibm.com/support/docview.wss?uid=swg21677828
- HPSBMU03074 vendor-advisory
- 59300 third-party-advisory
- 58667 third-party-advisory
- GLSA-201407-05 vendor-advisory
- 59284 third-party-advisory
- http://www.ibm.com/support/docview.wss?uid=swg24037783
- http://www-01.ibm.com/support/docview.wss?uid=swg21677695
- http://www-01.ibm.com/support/docview.wss?uid=swg21676529
- http://advisories.mageia.org/MGASA-2014-0204.html
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163
- http://www-01.ibm.com/support/docview.wss?uid=swg21676889
- FEDORA-2014-9308 vendor-advisory
- 58945 third-party-advisory
- [5.5] 005: RELIABILITY FIX: May 1, 2014 vendor-advisory
- 59440 third-party-advisory
- https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- 59655 third-party-advisory
- 59163 third-party-advisory
- DSA-2931 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21677836
- 59437 third-party-advisory
- http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754
- 59374 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2014-0006.html
- 59310 third-party-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc
- http://www.fortiguard.com/advisory/FG-IR-14-018/
- SUSE-SU-2015:0743 vendor-advisory
- http://www.ibm.com/support/docview.wss?uid=swg21676356
- HPSBMU03057 vendor-advisory
- http://support.citrix.com/article/CTX140876
- http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757
- 58939 third-party-advisory
- 59514 third-party-advisory
- 20140605 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products vendor-advisory