openssl: multiple vulnerabilities
| Package(s): | openssl |
CVE #(s): | CVE-2014-3505
CVE-2014-3506
CVE-2014-3507
CVE-2014-3508
CVE-2014-3509
CVE-2014-3510
CVE-2014-3511
CVE-2014-3512
CVE-2014-5139
|
| Created: | August 7, 2014 |
Updated: | December 29, 2014 |
| Description: |
The August 6, 2014 OpenSSL security advisory describes a number of newly fixed vulnerabilities:
- CVE-2014-3508: various pretty-printing functions can leak information from the stack.
- CVE-2014-5139: a malicious server can cause clients to crash with a null pointer dereference.
- CVE-2014-3509: a malicious server can exploit a race condition to overwrite a block of freed memory.
- CVE-2014-3505: a double-free vulnerability can be exploited to force a crash.
- CVE-2014-3506: denial of service by forcing the consumption of large amounts of memory.
- CVE-2014-3507: an exploitable memory leak.
- CVE-2014-3510: a malicious server can force a client crash.
- CVE-2014-3511: a man-in-the-middle attacker can force a downgrade to TLS 1.0.
- CVE-2014-3512: a buffer overrun on either server or client side when SRP is in use.
|
| Alerts: |
|
