CVE-2014-2896

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

2.77%

Published

Jan 28, 2020

Modified

Nov 20, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-125

Affected Products (1)

wolfssl · wolfssl (up to 2.9.4)vulnerable

References (8)

http://seclists.org/oss-sec/2014/q2/126

Mailing ListThird Party Advisory

http://seclists.org/oss-sec/2014/q2/130

Mailing ListThird Party Advisory

http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html

Vendor Advisory

http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html

Vendor Advisory

http://seclists.org/oss-sec/2014/q2/126

Mailing ListThird Party Advisory

http://seclists.org/oss-sec/2014/q2/130

Mailing ListThird Party Advisory

http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html

Vendor Advisory

http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs