CVE Feed

    Dashboard / CVE / CVE-2014-0198

    CVE-2014-0198

    The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.

    Published:Apr 21, 2014
    Last Modified:Apr 12, 2025
    EPS:May 6, 2014
    EPSS Score:0.34862
    CVSS Score:4.3

    Affected Products

    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Mariadb
    Product
    Mariadb
    Vendor
    Openssl
    Product
    Openssl
    Vendor
    Opensuse
    Product
    Opensuse
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Storage
    Vendor
    Suse
    Product
    Linux Enterprise Desktop
    Vendor
    Suse
    Product
    Linux Enterprise Server
    Vendor
    Suse
    Product
    Linux Enterprise Software Development Kit
    Vendor
    Suse
    Product
    Linux Enterprise Workstation Extension

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-476 NULL Pointer Dereference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-77118 (CVSS 8.4) — A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pc…
    CVE-2026-56968 (CVSS 3.7) — GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, w…
    CVE-2026-49975 (CVSS 7.5) — Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of …
    CVE-2026-9256 (CVSS 9.2) — NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerabilit…
    CVE-2026-31431 (CVSS 7.8) — In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating …
    CVE-2026-34757 (CVSS 5.1) — LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network …
    CVE-2026-4775 (CVSS 7.8) — A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerabili…
    CVE-2025-63261 (CVSS 7.8) — AWStats 8.0 is vulnerable to Command Injection via the open function…
    CVE-2026-3497 (CVSS 6.9) — Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects …
    CVE-2026-1940 (CVSS 5.1) — An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The p…

    References

    http://advisories.mageia.org/MGASA-2014-0204.html
    http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
    http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195
    http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
    http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
    http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
    http://lists.opensuse.org/opensuse-updates/2014-05/msg00036.html
    http://lists.opensuse.org/opensuse-updates/2014-05/msg00037.html
    http://marc.info/?l=bugtraq&m=140389274407904&w=2
    http://marc.info/?l=bugtraq&m=140389355508263&w=2
    http://marc.info/?l=bugtraq&m=140431828824371&w=2
    http://marc.info/?l=bugtraq&m=140448122410568&w=2
    http://marc.info/?l=bugtraq&m=140544599631400&w=2
    http://marc.info/?l=bugtraq&m=140621259019789&w=2
    http://marc.info/?l=bugtraq&m=140752315422991&w=2
    http://marc.info/?l=bugtraq&m=140904544427729&w=2
    http://marc.info/?l=bugtraq&m=141658880509699&w=2
    http://puppetlabs.com/security/cve/cve-2014-0198
    http://seclists.org/fulldisclosure/2014/Dec/23
    http://secunia.com/advisories/58337
    http://secunia.com/advisories/58667
    http://secunia.com/advisories/58713
    http://secunia.com/advisories/58714
    http://secunia.com/advisories/58939
    http://secunia.com/advisories/58945
    http://secunia.com/advisories/58977
    http://secunia.com/advisories/59126
    http://secunia.com/advisories/59162
    http://secunia.com/advisories/59163
    http://secunia.com/advisories/59190
    http://secunia.com/advisories/59202
    http://secunia.com/advisories/59264
    http://secunia.com/advisories/59282
    http://secunia.com/advisories/59284
    http://secunia.com/advisories/59287
    http://secunia.com/advisories/59300
    http://secunia.com/advisories/59301
    http://secunia.com/advisories/59306
    http://secunia.com/advisories/59310
    http://secunia.com/advisories/59342
    http://secunia.com/advisories/59374
    http://secunia.com/advisories/59398
    http://secunia.com/advisories/59413
    http://secunia.com/advisories/59437
    http://secunia.com/advisories/59438
    http://secunia.com/advisories/59440
    http://secunia.com/advisories/59449
    http://secunia.com/advisories/59450
    http://secunia.com/advisories/59490
    http://secunia.com/advisories/59491
    http://secunia.com/advisories/59514
    http://secunia.com/advisories/59525
    http://secunia.com/advisories/59529
    http://secunia.com/advisories/59655
    http://secunia.com/advisories/59666
    http://secunia.com/advisories/59669
    http://secunia.com/advisories/59721
    http://secunia.com/advisories/59784
    http://secunia.com/advisories/59990
    http://secunia.com/advisories/60049
    http://secunia.com/advisories/60066
    http://secunia.com/advisories/60571
    http://secunia.com/advisories/61254
    http://security.gentoo.org/glsa/glsa-201407-05.xml
    http://support.citrix.com/article/CTX140876
    http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15329.html
    http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl
    http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163
    http://www-01.ibm.com/support/docview.wss?uid=swg21673137
    http://www-01.ibm.com/support/docview.wss?uid=swg21676035
    http://www-01.ibm.com/support/docview.wss?uid=swg21676062
    http://www-01.ibm.com/support/docview.wss?uid=swg21676419
    http://www-01.ibm.com/support/docview.wss?uid=swg21676529
    http://www-01.ibm.com/support/docview.wss?uid=swg21676655
    http://www-01.ibm.com/support/docview.wss?uid=swg21676879
    http://www-01.ibm.com/support/docview.wss?uid=swg21676889
    http://www-01.ibm.com/support/docview.wss?uid=swg21677527
    http://www-01.ibm.com/support/docview.wss?uid=swg21677695
    http://www-01.ibm.com/support/docview.wss?uid=swg21677828
    http://www-01.ibm.com/support/docview.wss?uid=swg21677836
    http://www-01.ibm.com/support/docview.wss?uid=swg21678167
    http://www-01.ibm.com/support/docview.wss?uid=swg21683332
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757
    http://www.blackberry.com/btsc/KB36051
    http://www.debian.org/security/2014/dsa-2931
    http://www.fortiguard.com/advisory/FG-IR-14-018/
    http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm
    http://www.ibm.com/support/docview.wss?uid=swg21676356
    http://www.ibm.com/support/docview.wss?uid=swg24037783
    http://www.mandriva.com/security/advisories?name=MDVSA-2014:080
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
    http://www.openbsd.org/errata55.html#005_openssl
    http://www.openssl.org/news/secadv_20140605.txt
    http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
    http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
    http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
    http://www.securityfocus.com/archive/1/534161/100/0/threaded
    http://www.securityfocus.com/bid/67193
    http://www.vmware.com/security/advisories/VMSA-2014-0006.html
    http://www.vmware.com/security/advisories/VMSA-2014-0012.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1093837
    https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946
    https://kb.bluecoat.com/index?page=content&id=SA80
    https://kc.mcafee.com/corporate/index?page=content&id=SB10075
    https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321
    https://www.novell.com/support/kb/doc.php?id=7015271
    http://advisories.mageia.org/MGASA-2014-0204.html
    http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
    http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195
    http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
    http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
    http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
    http://lists.opensuse.org/opensuse-updates/2014-05/msg00036.html
    http://lists.opensuse.org/opensuse-updates/2014-05/msg00037.html
    http://marc.info/?l=bugtraq&m=140389274407904&w=2
    http://marc.info/?l=bugtraq&m=140389355508263&w=2
    http://marc.info/?l=bugtraq&m=140431828824371&w=2
    http://marc.info/?l=bugtraq&m=140448122410568&w=2
    http://marc.info/?l=bugtraq&m=140544599631400&w=2
    http://marc.info/?l=bugtraq&m=140621259019789&w=2
    http://marc.info/?l=bugtraq&m=140752315422991&w=2
    http://marc.info/?l=bugtraq&m=140904544427729&w=2
    http://marc.info/?l=bugtraq&m=141658880509699&w=2
    http://puppetlabs.com/security/cve/cve-2014-0198
    http://seclists.org/fulldisclosure/2014/Dec/23
    http://secunia.com/advisories/58337
    http://secunia.com/advisories/58667
    http://secunia.com/advisories/58713
    http://secunia.com/advisories/58714
    http://secunia.com/advisories/58939
    http://secunia.com/advisories/58945
    http://secunia.com/advisories/58977
    http://secunia.com/advisories/59126
    http://secunia.com/advisories/59162
    http://secunia.com/advisories/59163
    http://secunia.com/advisories/59190
    http://secunia.com/advisories/59202
    http://secunia.com/advisories/59264
    http://secunia.com/advisories/59282
    http://secunia.com/advisories/59284
    http://secunia.com/advisories/59287
    http://secunia.com/advisories/59300
    http://secunia.com/advisories/59301
    http://secunia.com/advisories/59306
    http://secunia.com/advisories/59310
    http://secunia.com/advisories/59342
    http://secunia.com/advisories/59374
    http://secunia.com/advisories/59398
    http://secunia.com/advisories/59413
    http://secunia.com/advisories/59437
    http://secunia.com/advisories/59438
    http://secunia.com/advisories/59440
    http://secunia.com/advisories/59449
    http://secunia.com/advisories/59450
    http://secunia.com/advisories/59490
    http://secunia.com/advisories/59491
    http://secunia.com/advisories/59514
    http://secunia.com/advisories/59525
    http://secunia.com/advisories/59529
    http://secunia.com/advisories/59655
    http://secunia.com/advisories/59666
    http://secunia.com/advisories/59669
    http://secunia.com/advisories/59721
    http://secunia.com/advisories/59784
    http://secunia.com/advisories/59990
    http://secunia.com/advisories/60049
    http://secunia.com/advisories/60066
    http://secunia.com/advisories/60571
    http://secunia.com/advisories/61254
    http://security.gentoo.org/glsa/glsa-201407-05.xml
    http://support.citrix.com/article/CTX140876
    http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15329.html
    http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl
    http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163
    http://www-01.ibm.com/support/docview.wss?uid=swg21673137
    http://www-01.ibm.com/support/docview.wss?uid=swg21676035
    http://www-01.ibm.com/support/docview.wss?uid=swg21676062
    http://www-01.ibm.com/support/docview.wss?uid=swg21676419
    http://www-01.ibm.com/support/docview.wss?uid=swg21676529
    http://www-01.ibm.com/support/docview.wss?uid=swg21676655
    http://www-01.ibm.com/support/docview.wss?uid=swg21676879
    http://www-01.ibm.com/support/docview.wss?uid=swg21676889
    http://www-01.ibm.com/support/docview.wss?uid=swg21677527
    http://www-01.ibm.com/support/docview.wss?uid=swg21677695
    http://www-01.ibm.com/support/docview.wss?uid=swg21677828
    http://www-01.ibm.com/support/docview.wss?uid=swg21677836
    http://www-01.ibm.com/support/docview.wss?uid=swg21678167
    http://www-01.ibm.com/support/docview.wss?uid=swg21683332
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756
    http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757
    http://www.blackberry.com/btsc/KB36051
    http://www.debian.org/security/2014/dsa-2931
    http://www.fortiguard.com/advisory/FG-IR-14-018/
    http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm
    http://www.ibm.com/support/docview.wss?uid=swg21676356
    http://www.ibm.com/support/docview.wss?uid=swg24037783
    http://www.mandriva.com/security/advisories?name=MDVSA-2014:080
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
    http://www.openbsd.org/errata55.html#005_openssl
    http://www.openssl.org/news/secadv_20140605.txt
    http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
    http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
    http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
    http://www.securityfocus.com/archive/1/534161/100/0/threaded
    http://www.securityfocus.com/bid/67193
    http://www.vmware.com/security/advisories/VMSA-2014-0006.html
    http://www.vmware.com/security/advisories/VMSA-2014-0012.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1093837
    https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946
    https://kb.bluecoat.com/index?page=content&id=SA80
    https://kc.mcafee.com/corporate/index?page=content&id=SB10075
    https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321
    https://www.novell.com/support/kb/doc.php?id=7015271

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High