Description

The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.

Remediation

References

CVE-2015-0207

Related Vulnerabilities

Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-13964)

Ruby Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-2339)

WordPress Plugin Image Source Control Security Bypass (2.3.0)

Oracle Database Server CVE-2020-2515 Vulnerability (CVE-2020-2515)

WordPress Plugin STT2 Extension Add Terms Unspecified Vulnerability (1.0.2)

Severity

Medium

Classification

CVE-2015-0207

Tags

Missing Update Known Vulnerabilities