Vulnerability-Lookup

CVE-2014-8176 (GCVE-0-2014-8176)

Vulnerability from cvelistv5 – Published: 2015-06-12 00:00 – Updated: 2024-08-06 13:10

Summary

The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.

Severity

No CVSS data available.

CWE

Assigner

redhat CNA under the redhat root

CNA scorecard B 81/100 over 1011 records in the last 180 days details

References

21 references

URL	Tags
http://www.debian.org/security/2015/dsa-3287	vendor-advisory
https://kc.mcafee.com/corporate/index?page=conten…
http://fortiguard.com/advisory/openssl-vulnerabil…
https://openssl.org/news/secadv/20150611.txt
http://rhn.redhat.com/errata/RHSA-2015-1115.html	vendor-advisory
https://h20566.www2.hpe.com/portal/site/hpsc/publ…
http://www.securitytracker.com/id/1032564	vdb-entry
http://tools.cisco.com/security/center/content/Ci…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://www.securityfocus.com/bid/75159	vdb-entry
http://www.ubuntu.com/usn/USN-2639-1	vendor-advisory
http://www.fortiguard.com/advisory/openssl-vulner…
https://github.com/openssl/openssl/commit/470990f…
https://security.gentoo.org/glsa/201506-02	vendor-advisory
https://rt.openssl.org/Ticket/Display.html?id=328…
http://rhn.redhat.com/errata/RHSA-2016-2957.html	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://bto.bluecoat.com/security-advisory/sa98
http://ftp.netbsd.org/pub/NetBSD/security/advisor…	vendor-advisory
https://www.openssl.org/news/secadv_20150611.txt
https://cert-portal.siemens.com/productcert/pdf/s…

Date Public

2015-06-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:10:50.919Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3287",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3287"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10122"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://openssl.org/news/secadv/20150611.txt"
          },
          {
            "name": "RHSA-2015:1115",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1115.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351"
          },
          {
            "name": "1032564",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1032564"
          },
          {
            "name": "20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl"
          },
          {
            "name": "openSUSE-SU-2015:1277",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html"
          },
          {
            "name": "75159",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75159"
          },
          {
            "name": "USN-2639-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2639-1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/470990fee0182566d439ef7e82d1abf18b7085d7"
          },
          {
            "name": "GLSA-201506-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201506-02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://rt.openssl.org/Ticket/Display.html?id=3286\u0026user=guest\u0026pass=guest"
          },
          {
            "name": "RHSA-2016:2957",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2957.html"
          },
          {
            "name": "SUSE-SU-2015:1185",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bto.bluecoat.com/security-advisory/sa98"
          },
          {
            "name": "NetBSD-SA2015-008",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv_20150611.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-06-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-13T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "DSA-3287",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3287"
        },
        {
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10122"
        },
        {
          "url": "http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015"
        },
        {
          "url": "https://openssl.org/news/secadv/20150611.txt"
        },
        {
          "name": "RHSA-2015:1115",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1115.html"
        },
        {
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351"
        },
        {
          "name": "1032564",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securitytracker.com/id/1032564"
        },
        {
          "name": "20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl"
        },
        {
          "name": "openSUSE-SU-2015:1277",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html"
        },
        {
          "name": "75159",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/75159"
        },
        {
          "name": "USN-2639-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2639-1"
        },
        {
          "url": "http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/470990fee0182566d439ef7e82d1abf18b7085d7"
        },
        {
          "name": "GLSA-201506-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201506-02"
        },
        {
          "url": "https://rt.openssl.org/Ticket/Display.html?id=3286\u0026user=guest\u0026pass=guest"
        },
        {
          "name": "RHSA-2016:2957",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2957.html"
        },
        {
          "name": "SUSE-SU-2015:1185",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html"
        },
        {
          "url": "https://bto.bluecoat.com/security-advisory/sa98"
        },
        {
          "name": "NetBSD-SA2015-008",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc"
        },
        {
          "url": "https://www.openssl.org/news/secadv_20150611.txt"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-8176",
    "datePublished": "2015-06-12T00:00:00.000Z",
    "dateReserved": "2014-10-10T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:10:50.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-8176",
      "date": "2026-10-14",
      "epss": "0.16587",
      "percentile": "0.96971"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A28EB262-0B86-4956-B15A-66E93EBA408F",
                    "versionEndIncluding": "0.9.8z",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2FBD8C92-6138-4274-ACBA-D7D42DAEC5AC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:*",
                    "matchCriteriaId": "3A2075BD-6102-4B0F-839A-836E9585F43B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:*",
                    "matchCriteriaId": "2A2FA09E-2BF7-4968-B62D-00DA57F81EA1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:*",
                    "matchCriteriaId": "F02E634E-1E3D-4E44-BADA-76F92483A732",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0:beta4:*:*:*:*:*:*",
                    "matchCriteriaId": "FCC2B07A-49EF-411F-8A4D-89435E22B043",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0:beta5:*:*:*:*:*:*",
                    "matchCriteriaId": "7E9480D6-3B6A-4C41-B8C1-C3F945040772",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*",
                    "matchCriteriaId": "10FF0A06-DA61-4250-B083-67E55E362677",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8A6BA453-C150-4159-B80B-5465EFF83F11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*",
                    "matchCriteriaId": "638A2E69-8AB6-4FEA-852A-FEF16A500C1A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*",
                    "matchCriteriaId": "56C47D3A-B99D-401D-B6B8-1194B2DB4809",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:*",
                    "matchCriteriaId": "08355B10-E004-4BE6-A5AE-4D428810580B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:*",
                    "matchCriteriaId": "738BCFDC-1C49-4774-95AE-E099F707DEF9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D4B242C0-D27D-4644-AD19-5ACB853C9DC2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8DC683F2-4346-4E5E-A8D7-67B4F4D7827B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:*",
                    "matchCriteriaId": "764B7D38-BC1B-47DB-B1DF-D092BDA4BFCB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6604E7BE-9F9B-444D-A63A-F65D1CFDF3BF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0k:*:*:*:*:*:*:*",
                    "matchCriteriaId": "132B9217-B0E0-4E3E-9096-162AA28E158E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.0l:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7619F9A0-9054-4217-93D1-3EA64876C5B0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2D1C00C0-C77E-4255-9ECA-20F2673C7366",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*",
                    "matchCriteriaId": "21F16D65-8A46-4AC7-8970-73AB700035FB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*",
                    "matchCriteriaId": "92F393FF-7E6F-4671-BFBF-060162E12659",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*",
                    "matchCriteriaId": "E1B85A09-CF8D-409D-966E-168F9959F6F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3A66E6CF-39CF-412E-8EF0-8E10BA21B4A4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C684FB18-FDDC-4BED-A28C-C23EE6CD0094",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A74A79A7-4FAF-4C81-8622-050008B96AE1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CEDACCB9-8D61-49EE-9957-9E58BC7BB031",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4993DD56-F9E3-4AC8-AC3E-BF204B950DEC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E884B241-F9C3-44F8-A420-DE65F5F3D660",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3A383620-B4F7-44A7-85DA-A4FF2E115D80",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data."
          },
          {
            "lang": "es",
            "value": "La funci\u00f3n dtls1_clear_queues en ssl/d1_lib.c en OpenSSL anterior a 0.9.8za, 1.0.0 anterior a 1.0.0m, y 1.0.1 anterior a 1.0.1h libera estructuras de datos sin considerar que los datos de la aplicaci\u00f3n puedan llegar entre un mensaje ChangeCipherSpec y un mensaje Finished, lo que permite a pares remotos de DTLS causar una denegaci\u00f3n de servicio (corrupci\u00f3n de memoria y ca\u00edda de aplicaci\u00f3n) o posiblemente tener otro impacto no especificado a trav\u00e9s de datos de la aplicaci\u00f3n no esperados."
          }
        ],
        "id": "CVE-2014-8176",
        "lastModified": "2026-05-06T22:30:45.220",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2015-06-12T19:59:00.070",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1115.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2957.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.debian.org/security/2015/dsa-3287"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.securityfocus.com/bid/75159"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.securitytracker.com/id/1032564"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.ubuntu.com/usn/USN-2639-1"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bto.bluecoat.com/security-advisory/sa98"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://github.com/openssl/openssl/commit/470990fee0182566d439ef7e82d1abf18b7085d7"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10122"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://openssl.org/news/secadv/20150611.txt"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Exploit"
            ],
            "url": "https://rt.openssl.org/Ticket/Display.html?id=3286\u0026user=guest\u0026pass=guest"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://security.gentoo.org/glsa/201506-02"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.openssl.org/news/secadv_20150611.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1115.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2957.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.debian.org/security/2015/dsa-3287"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/75159"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securitytracker.com/id/1032564"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.ubuntu.com/usn/USN-2639-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://bto.bluecoat.com/security-advisory/sa98"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/openssl/openssl/commit/470990fee0182566d439ef7e82d1abf18b7085d7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10122"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://openssl.org/news/secadv/20150611.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit"
            ],
            "url": "https://rt.openssl.org/Ticket/Display.html?id=3286\u0026user=guest\u0026pass=guest"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://security.gentoo.org/glsa/201506-02"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.openssl.org/news/secadv_20150611.txt"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-119"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-21T05:33:12+00:00",
      "cve": "CVE-2014-8176",
      "id": "CVE-2014-8176",
      "initial_release_date": "2014-01-01T00:00:00+00:00",
      "product_status:fixed": "153",
      "product_status:known_affected": "7",
      "product_status:known_not_affected": "5",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "OpenSSL: Invalid free in DTLS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2014/cve-2014-8176.json",
      "version": "3"
    }
  }
}

OPENSUSE-SU-2024:10309-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 19:56

Summary

libcrypto38-2.5.0-1.1 on GA media

Severity

Moderate

Scope

30 vulnerabilities in this advisory, including CVE-2014-8176.

CVE-2014-8176

Recommended: 40 products

Open the full advisory

RHSA-2015:1115

Vulnerability from csaf_opensuse - Published: 2015-06-15 00:00 - Updated: 2026-09-20 10:54

Summary

security update for openssl

Severity

Moderate

Scope

6 vulnerabilities in this advisory, including CVE-2014-8176.

CVE-2014-8176

Recommended: 8 products

Open the full advisory

RHSA-2016:2957

Vulnerability from csaf_redhat - Published: 2016-12-15 22:11 - Updated: 2026-09-21 05:32

Summary

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP 2.4.23 Release

Severity

Important

Scope

44 vulnerabilities in this advisory, including CVE-2014-8176.

CVE-2014-8176

An invalid-free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could send a specially crafted message to the peer, which could cause the application to crash or potentially result in arbitrary code execution.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2016:2957

Open the full advisory

SSA-412672

Vulnerability from csaf_siemens - Published: 2022-12-13 00:00 - Updated: 2022-12-13 00:00

Summary

SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7

Scope

83 vulnerabilities in this advisory, including CVE-2014-8176.

CVE-2014-8176

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Known affected: 5 products

https://support.industry.siemens.com/cs/ww/en/view/109814809/

Open the full advisory

SUSE-RU-2015:0769-1

Vulnerability from csaf_suse - Published: 2014-10-22 23:22 - Updated: 2026-09-20 11:57

Summary

Security update for openssl1

Severity

Moderate

Scope

41 vulnerabilities in this advisory, including CVE-2014-8176.

CVE-2014-8176

Recommended: 24 products

Open the full advisory

SUSE-SU-2015:0546-1

Vulnerability from csaf_suse - Published: 2014-10-22 23:22 - Updated: 2026-09-20 12:01

Summary

Security update for openssl1

Severity

Moderate

Scope

41 vulnerabilities in this advisory, including CVE-2014-8176.

CVE-2014-8176

Recommended: 24 products

Open the full advisory

SUSE-SU-2015:1185-1

Vulnerability from csaf_suse - Published: 2014-10-22 23:22 - Updated: 2026-09-20 12:04

Summary

Security update for openssl1

Severity

Moderate

Scope

41 vulnerabilities in this advisory, including CVE-2014-8176.

CVE-2014-8176

Recommended: 24 products

Open the full advisory

UBUNTU-CVE-2014-8176 (CVE-2014-8176)

Vulnerability from osv_ubuntu – Published: 2015-06-11 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2014-8176	REPORT
	https://www.openssl.org/news/secadv_20150611.txt	REPORT
	https://ubuntu.com/security/notices/USN-2639-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2014-8176	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libssl1.0.0",
            "binary_version": "1.0.1f-1ubuntu2.15"
          },
          {
            "binary_name": "openssl",
            "binary_version": "1.0.1f-1ubuntu2.15"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "openssl",
        "purl": "pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.15?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1f-1ubuntu2.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1e-3ubuntu1",
        "1.0.1e-4ubuntu1",
        "1.0.1e-4ubuntu2",
        "1.0.1e-4ubuntu3",
        "1.0.1e-4ubuntu4",
        "1.0.1f-1ubuntu1",
        "1.0.1f-1ubuntu2",
        "1.0.1f-1ubuntu2.1",
        "1.0.1f-1ubuntu2.2",
        "1.0.1f-1ubuntu2.3",
        "1.0.1f-1ubuntu2.4",
        "1.0.1f-1ubuntu2.5",
        "1.0.1f-1ubuntu2.7",
        "1.0.1f-1ubuntu2.8",
        "1.0.1f-1ubuntu2.11",
        "1.0.1f-1ubuntu2.12"
      ]
    }
  ],
  "aliases": [],
  "details": "The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.",
  "id": "UBUNTU-CVE-2014-8176",
  "modified": "2026-04-22T07:37:44Z",
  "published": "2015-06-11T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8176"
    },
    {
      "type": "REPORT",
      "url": "https://www.openssl.org/news/secadv_20150611.txt"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2639-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-8176"
    }
  ],
  "related": [
    "USN-2639-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2014-8176"
  ]
}

WID-SEC-W-2026-0180

Vulnerability from csaf_certbund - Published: 2026-01-20 23:00 - Updated: 2026-01-20 23:00

Summary

Dell Data Protection Advisor: Mehrere Schwachstellen

Severity

Hoch

Scope

378 vulnerabilities in this advisory, including CVE-2014-8176.

CVE-2014-8176

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2014-8176 (GCVE-0-2014-8176)

UBUNTU-CVE-2014-8176 (CVE-2014-8176)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour