CVE-2014-3507

CVE-2014-3507

Published · Updated

Follow this CVE+ Monitor openssl

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

15Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 55%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (3 components)
Red Hat Enterprise Virtualization 3
none_available: Affected
Fixed
17 products (154 components)
Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux Server (v. 6) · Red Hat Enterprise Linux Server Optional (v. 7) · Red Hat Enterprise Linux Server Optional (v. 6) · Red Hat Enterprise Linux Desktop Optional (v. 6) · and others 12
fix ↗
Not affected
7 products (10 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 5 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat JBoss Enterprise Application Platform 5 · Red Hat JBoss Enterprise Application Platform 6 · and others 2
Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.
Affected products
n/a · n/a