Vulnerability CVE-2014-3512: Information

Description

Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.

Severity: HIGH (7.5)

URL: https://nvd.nist.gov/vuln/detail/CVE-2014-3512

Published: Aug. 14, 2014

Modified: Nov. 7, 2023

Error type identifier: CWE-119

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
openssl10	p9	1.0.1j-alt1	1.0.2u-alt1.p9.2	ALT-PU-2014-2312-1	133582	Fixed
openssl10	c9f2	1.0.1j-alt1	1.0.2u-alt1.p9.1	ALT-PU-2014-2312-1	133582	Fixed
openssl10	c7	1.0.1j-alt1.M70C.1	1.0.1u-alt0.M70C.1	ALT-PU-2014-2316-1	133754	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://www.openssl.org/news/secadv_20140806.txt	Vendor Advisory
69083
http://www.tenable.com/security/tns-2014-06
60810
60917
NetBSD-SA2014-008
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
60921
DSA-2998
openSUSE-SU-2014:1052
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm
61775
61959
http://www-01.ibm.com/support/docview.wss?uid=swg21686997
http://www-01.ibm.com/support/docview.wss?uid=swg21682293
59756
GLSA-201412-39
SSRT101846
FreeBSD-SA-14:18
[syslog-ng-announce] 20140910 syslog-ng Premium Edition 5 LTS (5.0.6a) has been released
http://www-01.ibm.com/support/docview.wss?uid=swg21683389
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240
1030693
http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15565.html
61184
61171
61100
61017
60803
60493
60221
60022
59710
59700
openssl-cve20143512-dos(95158)
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=4a23b12a031860253b58d503f296377ca076427b

Affected configurations:
1. Configuration 1
  cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0m:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0k:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta4:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta5:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0l:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:*

Version: v24.5.3

Vulnerability CVE-2014-3512: Information

Description

Fixed packages

References to Advisories, Solutions, and Tools

Configuration 1