CVE Feed

    Dashboard / CVE / CVE-2014-0195

    CVE-2014-0195

    The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

    Published:Jun 5, 2014
    Last Modified:Apr 12, 2025
    EPS:Jun 5, 2014
    EPSS Score:0.9232
    CVSS Score:6.8

    Affected Products

    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Mariadb
    Product
    Mariadb
    Vendor
    Openssl
    Product
    Openssl
    Vendor
    Opensuse
    Product
    Leap
    Vendor
    Opensuse
    Product
    Opensuse
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Storage

    Exploits

    https://github.com/PezwariNaan/CVE-2014-0195https://github.com/ricedu/CVE-2014-0195

    Related CVEs

    CVE-2026-54231 (CVSS 5.5) — A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The ev…
    CVE-2026-54230 (CVSS 7) — A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event …
    CVE-2026-35094 (CVSS 3.3) — A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directorie…
    CVE-2026-35093 (CVSS 8.8) — A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain …
    CVE-2024-3056 (CVSS 7.7) — A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, whe…
    CVE-2024-6293 (CVSS 8.8) — Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially explo…
    CVE-2024-6292 (CVSS 8.8) — Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially explo…
    CVE-2024-6291 (CVSS 8.8) — Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentiall…
    CVE-2024-6290 (CVSS 8.8) — Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially explo…
    CVE-2024-38277 (CVSS 5.4) — A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be…

    References

    http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc
    http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048
    http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
    http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
    http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
    http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
    http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
    http://marc.info/?l=bugtraq&m=140266410314613&w=2
    http://marc.info/?l=bugtraq&m=140317760000786&w=2
    http://marc.info/?l=bugtraq&m=140389274407904&w=2
    http://marc.info/?l=bugtraq&m=140389355508263&w=2
    http://marc.info/?l=bugtraq&m=140431828824371&w=2
    http://marc.info/?l=bugtraq&m=140448122410568&w=2
    http://marc.info/?l=bugtraq&m=140482916501310&w=2
    http://marc.info/?l=bugtraq&m=140491231331543&w=2
    http://marc.info/?l=bugtraq&m=140499827729550&w=2
    http://marc.info/?l=bugtraq&m=140621259019789&w=2
    http://marc.info/?l=bugtraq&m=140752315422991&w=2
    http://marc.info/?l=bugtraq&m=140904544427729&w=2
    http://marc.info/?l=bugtraq&m=142660345230545&w=2
    http://seclists.org/fulldisclosure/2014/Dec/23
    http://secunia.com/advisories/58337
    http://secunia.com/advisories/58615
    http://secunia.com/advisories/58660
    http://secunia.com/advisories/58713
    http://secunia.com/advisories/58714
    http://secunia.com/advisories/58743
    http://secunia.com/advisories/58883
    http://secunia.com/advisories/58939
    http://secunia.com/advisories/58945
    http://secunia.com/advisories/58977
    http://secunia.com/advisories/59040
    http://secunia.com/advisories/59126
    http://secunia.com/advisories/59162
    http://secunia.com/advisories/59175
    http://secunia.com/advisories/59188
    http://secunia.com/advisories/59189
    http://secunia.com/advisories/59192
    http://secunia.com/advisories/59223
    http://secunia.com/advisories/59287
    http://secunia.com/advisories/59300
    http://secunia.com/advisories/59301
    http://secunia.com/advisories/59305
    http://secunia.com/advisories/59306
    http://secunia.com/advisories/59310
    http://secunia.com/advisories/59342
    http://secunia.com/advisories/59364
    http://secunia.com/advisories/59365
    http://secunia.com/advisories/59413
    http://secunia.com/advisories/59429
    http://secunia.com/advisories/59437
    http://secunia.com/advisories/59441
    http://secunia.com/advisories/59449
    http://secunia.com/advisories/59450
    http://secunia.com/advisories/59451
    http://secunia.com/advisories/59454
    http://secunia.com/advisories/59490
    http://secunia.com/advisories/59491
    http://secunia.com/advisories/59514
    http://secunia.com/advisories/59518
    http://secunia.com/advisories/59528
    http://secunia.com/advisories/59530
    http://secunia.com/advisories/59587
    http://secunia.com/advisories/59655
    http://secunia.com/advisories/59659
    http://secunia.com/advisories/59666
    http://secunia.com/advisories/59669
    http://secunia.com/advisories/59721
    http://secunia.com/advisories/59784
    http://secunia.com/advisories/59895
    http://secunia.com/advisories/59990
    http://secunia.com/advisories/60571
    http://secunia.com/advisories/61254
    http://security.gentoo.org/glsa/glsa-201407-05.xml
    http://support.apple.com/kb/HT6443
    http://support.citrix.com/article/CTX140876
    http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15356.html
    http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl
    http://www-01.ibm.com/support/docview.wss?uid=isg400001841
    http://www-01.ibm.com/support/docview.wss?uid=isg400001843
    http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163
    http://www-01.ibm.com/support/docview.wss?uid=swg21673137
    http://www-01.ibm.com/support/docview.wss?uid=swg21675821
    http://www-01.ibm.com/support/docview.wss?uid=swg21676035
    http://www-01.ibm.com/support/docview.wss?uid=swg21676062
    http://www-01.ibm.com/support/docview.wss?uid=swg21676071
    http://www-01.ibm.com/support/docview.wss?uid=swg21676419
    http://www-01.ibm.com/support/docview.wss?uid=swg21676644
    http://www-01.ibm.com/support/docview.wss?uid=swg21676879
    http://www-01.ibm.com/support/docview.wss?uid=swg21676889
    http://www-01.ibm.com/support/docview.wss?uid=swg21677527
    http://www-01.ibm.com/support/docview.wss?uid=swg21677695
    http://www-01.ibm.com/support/docview.wss?uid=swg21677828
    http://www-01.ibm.com/support/docview.wss?uid=swg21678167
    http://www-01.ibm.com/support/docview.wss?uid=swg21678289
    http://www-01.ibm.com/support/docview.wss?uid=swg21683332
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757
    http://www.blackberry.com/btsc/KB36051
    http://www.f-secure.com/en/web/labs_global/fsc-2014-6
    http://www.fortiguard.com/advisory/FG-IR-14-018/
    http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm
    http://www.ibm.com/support/docview.wss?uid=swg21676356
    http://www.ibm.com/support/docview.wss?uid=swg21676793
    http://www.ibm.com/support/docview.wss?uid=swg24037783
    http://www.mandriva.com/security/advisories?name=MDVSA-2014:106
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
    http://www.openssl.org/news/secadv_20140605.txt
    http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
    http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
    http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
    http://www.securityfocus.com/archive/1/534161/100/0/threaded
    http://www.securityfocus.com/bid/67900
    http://www.securitytracker.com/id/1030337
    http://www.vmware.com/security/advisories/VMSA-2014-0006.html
    http://www.vmware.com/security/advisories/VMSA-2014-0012.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1103598
    https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=1632ef744872edc2aa2a53d487d3e79c965a4ad3
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946
    https://kb.bluecoat.com/index?page=content&id=SA80
    https://kc.mcafee.com/corporate/index?page=content&id=SB10075
    https://www.novell.com/support/kb/doc.php?id=7015271
    http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc
    http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048
    http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
    http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
    http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
    http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
    http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
    http://marc.info/?l=bugtraq&m=140266410314613&w=2
    http://marc.info/?l=bugtraq&m=140317760000786&w=2
    http://marc.info/?l=bugtraq&m=140389274407904&w=2
    http://marc.info/?l=bugtraq&m=140389355508263&w=2
    http://marc.info/?l=bugtraq&m=140431828824371&w=2
    http://marc.info/?l=bugtraq&m=140448122410568&w=2
    http://marc.info/?l=bugtraq&m=140482916501310&w=2
    http://marc.info/?l=bugtraq&m=140491231331543&w=2
    http://marc.info/?l=bugtraq&m=140499827729550&w=2
    http://marc.info/?l=bugtraq&m=140621259019789&w=2
    http://marc.info/?l=bugtraq&m=140752315422991&w=2
    http://marc.info/?l=bugtraq&m=140904544427729&w=2
    http://marc.info/?l=bugtraq&m=142660345230545&w=2
    http://seclists.org/fulldisclosure/2014/Dec/23
    http://secunia.com/advisories/58337
    http://secunia.com/advisories/58615
    http://secunia.com/advisories/58660
    http://secunia.com/advisories/58713
    http://secunia.com/advisories/58714
    http://secunia.com/advisories/58743
    http://secunia.com/advisories/58883
    http://secunia.com/advisories/58939
    http://secunia.com/advisories/58945
    http://secunia.com/advisories/58977
    http://secunia.com/advisories/59040
    http://secunia.com/advisories/59126
    http://secunia.com/advisories/59162
    http://secunia.com/advisories/59175
    http://secunia.com/advisories/59188
    http://secunia.com/advisories/59189
    http://secunia.com/advisories/59192
    http://secunia.com/advisories/59223
    http://secunia.com/advisories/59287
    http://secunia.com/advisories/59300
    http://secunia.com/advisories/59301
    http://secunia.com/advisories/59305
    http://secunia.com/advisories/59306
    http://secunia.com/advisories/59310
    http://secunia.com/advisories/59342
    http://secunia.com/advisories/59364
    http://secunia.com/advisories/59365
    http://secunia.com/advisories/59413
    http://secunia.com/advisories/59429
    http://secunia.com/advisories/59437
    http://secunia.com/advisories/59441
    http://secunia.com/advisories/59449
    http://secunia.com/advisories/59450
    http://secunia.com/advisories/59451
    http://secunia.com/advisories/59454
    http://secunia.com/advisories/59490
    http://secunia.com/advisories/59491
    http://secunia.com/advisories/59514
    http://secunia.com/advisories/59518
    http://secunia.com/advisories/59528
    http://secunia.com/advisories/59530
    http://secunia.com/advisories/59587
    http://secunia.com/advisories/59655
    http://secunia.com/advisories/59659
    http://secunia.com/advisories/59666
    http://secunia.com/advisories/59669
    http://secunia.com/advisories/59721
    http://secunia.com/advisories/59784
    http://secunia.com/advisories/59895
    http://secunia.com/advisories/59990
    http://secunia.com/advisories/60571
    http://secunia.com/advisories/61254
    http://security.gentoo.org/glsa/glsa-201407-05.xml
    http://support.apple.com/kb/HT6443
    http://support.citrix.com/article/CTX140876
    http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15356.html
    http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl
    http://www-01.ibm.com/support/docview.wss?uid=isg400001841
    http://www-01.ibm.com/support/docview.wss?uid=isg400001843
    http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163
    http://www-01.ibm.com/support/docview.wss?uid=swg21673137
    http://www-01.ibm.com/support/docview.wss?uid=swg21675821
    http://www-01.ibm.com/support/docview.wss?uid=swg21676035
    http://www-01.ibm.com/support/docview.wss?uid=swg21676062
    http://www-01.ibm.com/support/docview.wss?uid=swg21676071
    http://www-01.ibm.com/support/docview.wss?uid=swg21676419
    http://www-01.ibm.com/support/docview.wss?uid=swg21676644
    http://www-01.ibm.com/support/docview.wss?uid=swg21676879
    http://www-01.ibm.com/support/docview.wss?uid=swg21676889
    http://www-01.ibm.com/support/docview.wss?uid=swg21677527
    http://www-01.ibm.com/support/docview.wss?uid=swg21677695
    http://www-01.ibm.com/support/docview.wss?uid=swg21677828
    http://www-01.ibm.com/support/docview.wss?uid=swg21678167
    http://www-01.ibm.com/support/docview.wss?uid=swg21678289
    http://www-01.ibm.com/support/docview.wss?uid=swg21683332
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757
    http://www.blackberry.com/btsc/KB36051
    http://www.f-secure.com/en/web/labs_global/fsc-2014-6
    http://www.fortiguard.com/advisory/FG-IR-14-018/
    http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm
    http://www.ibm.com/support/docview.wss?uid=swg21676356
    http://www.ibm.com/support/docview.wss?uid=swg21676793
    http://www.ibm.com/support/docview.wss?uid=swg24037783
    http://www.mandriva.com/security/advisories?name=MDVSA-2014:106
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
    http://www.openssl.org/news/secadv_20140605.txt
    http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
    http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
    http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
    http://www.securityfocus.com/archive/1/534161/100/0/threaded
    http://www.securityfocus.com/bid/67900
    http://www.securitytracker.com/id/1030337
    http://www.vmware.com/security/advisories/VMSA-2014-0006.html
    http://www.vmware.com/security/advisories/VMSA-2014-0012.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1103598
    https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=1632ef744872edc2aa2a53d487d3e79c965a4ad3
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946
    https://kb.bluecoat.com/index?page=content&id=SA80
    https://kc.mcafee.com/corporate/index?page=content&id=SB10075
    https://www.novell.com/support/kb/doc.php?id=7015271

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High