Description

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

Remediation

References

CVE-2014-3470

Related Vulnerabilities

TYPO3 Improper Input Validation Vulnerability (CVE-2019-11832)

WordPress Plugin Namaste! LMS Cross-Site Scripting (2.5.9.3)

Elgg URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-11016)

Joomla! Core 3.0.x Cross-Site Scripting (3.0.0 - 3.0.3)

Oracle Database Server Other Vulnerability (CVE-2007-1442)

Severity

Medium

Classification

CVE-2014-3470

Tags

Missing Update Known Vulnerabilities