Description
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.
References
- http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html
- http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html
- GLSA-201612-53 vendor-advisory
- [oss-security] 20140417 CVE ids for CyaSSL 2.9.4? mailing-list
- 66780 vdb-entry
- [oss-security] 20140418 Re: CVE ids for CyaSSL 2.9.4? mailing-list
- 57743 third-party-advisory