Unscored severity · published Aug 13, 2014
CVE-2014-3509
Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are…
–
CVSS
12.9%
EPSS
No
On KEV
Description
Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.
Exploitation
Is it being used?
Exploit prediction (EPSS)12.9% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openssl · Openssl
1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +25 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3509
aix.software.ibm.com
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
linux.oracle.com
http://linux.oracle.com/errata/ELSA-2014-1052.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html
More from Openssl
7.5
CVE-2014-0160
OpenSSL Information Disclosure Vulnerability
9.8
CVE-2026-63073
Untrusted Sender DN Used as Format String in CMP Response Validation
9.8
CVE-2026-31789
Heap Buffer Overflow in Hexadecimal Conversion
9.8
CVE-2022-2274
RSA implementation bug in AVX512IFMA instructions
9.8
CVE-2021-3711
SM2 Decryption Buffer Overflow