Every CVE Search/ Get API key

CVE-2014-0195

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0...

6.8 MediumPublic exploitFix available

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Exploit likelihood

100.0%Up 24.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Record
CVE-2014-0195
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-120
Updated
2026-11-02
CVE List No score

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Record
CVE-2014-0195
Updated
2026-11-02
EUVDEUVD-2014-0246 No score

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Record
EUVD-2014-0246
Updated
2026-11-03
GitHub AdvisoriesGHSA-r4qw-hxm9-9pf9 No score

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0...

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Record
GHSA-r4qw-hxm9-9pf9
Weakness
CWE-119, CWE-120
Updated
2026-11-02
OSVBELL-CVE-2014-0195 6.8

CVE-2014-0195 does not affect BellSoft software

Record
BELL-CVE-2014-0195
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSV No score

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Record
CVE-2014-0195
Updated
2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2014-0195 No score

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Record
DEBIAN-CVE-2014-0195
Updated
2026-11-02
OSVMGASA-2014-0255 No score

Updated openssl packages fix multiple vulnerabilties

Updated openssl packages fix security vulnerabilities:

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. (CVE-2014-0224)

Note: In order to exploit this flaw, both the server and the client must be using a vulnerable version of OpenSSL; the server must be using OpenSSL version 1.0.1 and above, and the client must be using any version of OpenSSL. For more information about this flaw, refer to RedHat article 904433 in the references. All currently supported versions of Mageia are running OpenSSL 1.0.1.

A buffer overflow flaw was found in the way OpenSSL handled invalid DTLS packet fragments. A remote attacker could possibly use this flaw to execute arbitrary code on a DTLS client or server. (CVE-2014-0195)

A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash. (CVE-2014-0221)

A NULL pointer dereference flaw was found in the way OpenSSL performed anonymous Elliptic Curve Diffie Hellman (ECDH) key exchange. A specially crafted handshake packet could cause a TLS/SSL client that has the anonymous ECDH cipher suite enabled to crash. (CVE-2014-3470)

Record
MGASA-2014-0255
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-RU-2015:0769-1
Updated
2026-11-02
OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0546-1
Updated
2026-11-02
OSVSUSE-SU-2015:0743-1 No score

Security update for mariadb

mariadb was updated to version 10.0.16 to fix 40 security issues.

These security issues were fixed:

  • CVE-2015-0411: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption (bnc#915911).
  • CVE-2015-0382: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allowed remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381 (bnc#915911).
  • CVE-2015-0381: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allowed remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382 (bnc#915911).
  • CVE-2015-0432: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allowed remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key (bnc#915911).
  • CVE-2014-6568: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allowed remote authenticated users to affect availability via vectors related to Server : InnoDB : DML (bnc#915911).
  • CVE-2015-0374: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allowed remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key (bnc#915911).
  • CVE-2014-6507: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (bnc#915912).
  • CVE-2014-6491: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6500 (bnc#915912).
  • CVE-2014-6500: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491 (bnc#915912).
  • CVE-2014-6469: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and eariler and 5.6.20 and earlier allowed remote authenticated users to affect availability via vectors related to SERVER:OPTIMIZER (bnc#915912).
  • CVE-2014-6555: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allowed remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (bnc#915912).
  • CVE-2014-6559: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING (bnc#915912).
  • CVE-2014-6494: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6496 (bnc#915912).
  • CVE-2014-6496: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494 (bnc#915912).
  • CVE-2014-6464: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allowed remote authenticated users to affect availability via vectors related to SERVER:INNODB DML FOREIGN KEYS (bnc#915912).
  • CVE-2010-5298: Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when…
Record
SUSE-SU-2015:0743-1
Updated
2026-11-02
OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1185-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0195 No score

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Record
UBUNTU-CVE-2014-0195
Updated
2026-11-02
OSVUSN-2232-1 No score

openssl vulnerabilities

Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS fragments. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0195)

Imre Rad discovered that OpenSSL incorrectly handled DTLS recursions. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2014-0221)

KIKUCHI Masashi discovered that OpenSSL incorrectly handled certain handshakes. A remote attacker could use this flaw to perform a machine-in-the-middle attack and possibly decrypt and modify traffic. (CVE-2014-0224)

Felix Gröbert and Ivan Fratrić discovered that OpenSSL incorrectly handled anonymous ECDH ciphersuites. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-3470)

Record
USN-2232-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 1.0.1h-1
1.0.1h-1
openssl
Debian:13
 before 1.0.1h-1
1.0.1h-1
openssl
Debian:14
 before 1.0.1h-1
1.0.1h-1
openssl
Debian:6.0
 before 0.9.8o-4squeeze15, plus listed versions
0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13
Show 9 moreShow less
0.9.8o-4squeeze140.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9
0.9.8o-4squeeze15
openssl
Debian:7
 before 1.0.1e-2+deb7u10, plus listed versions
1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u4
Show 5 moreShow less
1.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9
1.0.1e-2+deb7u10
openssl
Mageia:3
 before 1.0.1e-1.9.mga3
1.0.1e-1.9.mga3
openssl
Mageia:4
 before 1.0.1e-8.6.mga4
1.0.1e-8.6.mga4
openssl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
Show 54 moreShow less
Affected packages
PackageAffectedFixed
openssl-perl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
mariadb
SUSE:Linux Enterprise Desktop 12
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Software Development Kit 12
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Server 12
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Server for SAP Applications 12
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Workstation Extension 12
 before 10.0.16-15.1
10.0.16-15.1
openssl
Ubuntu:14.04:LTS
 before 1.0.1f-1ubuntu2.2, plus listed versions
1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu41.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.1
1.0.1f-1ubuntu2.2
openssl098
Ubuntu:14.04:LTS
 before 0.9.8o-7ubuntu3.2.14.04.1, plus listed versions
0.9.8o-7ubuntu3.1
0.9.8o-7ubuntu3.2.14.04.1
openssl-1_1
openSUSE:Tumbleweed
 before 1.1.1l-1.2
1.1.1l-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitOpenSSL DTLS Fragment Buffer Overflow DoS2014-06-05
PoC in GitHubPezwariNaan/CVE-2014-01952024-11-01
PoC in GitHubricedu/CVE-2014-01952014-06-10

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0195 is a medium vulnerability (CVSS 6.8) in Openssl, published June 5, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in openssl 1.0.1h-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 714 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open