CVE-2014-9424
published 2014-12-29CVE-2014-9424: Double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in d1_srtp.c in LibreSSL before 2.1.2 allows remote attackers to cause a denial of…
PriorityP431high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
1.80%
76.0th percentile
Double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in d1_srtp.c in LibreSSL before 2.1.2 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a certain length-verification error during processing of a DTLS handshake.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | libressl | <= 2.1.1 | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libressl: Double-free in ssl_parse_clienthello_use_srtp_ext() function
vendor_redhat·2014-12-29·CVSS 7.5
CVE-2014-9424 [HIGH] CWE-416 libressl: Double-free in ssl_parse_clienthello_use_srtp_ext() function
libressl: Double-free in ssl_parse_clienthello_use_srtp_ext() function
Double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in d1_srtp.c in LibreSSL before 2.1.2 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a certain length-verification error during processing of a DTLS handshake.
Statement: Not vulnerable. This issue does not affect the version of OpenSSL package as shipped with Red Hat Enterprise Linux 5, 6 and 7.
Package: openssl (Red Hat Enterprise Linux 5) - Not affected
Package: openssl (Red Hat Enterprise Linux 6) - Not affected
Package: openssl (Red Hat Enterprise Linux 7) - Not affected
GHSA
GHSA-8258-9w54-3r97: Double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in d1_srtp
ghsa_unreviewed·2022-05-17
CVE-2014-9424 [HIGH] GHSA-8258-9w54-3r97: Double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in d1_srtp
Double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in d1_srtp.c in LibreSSL before 2.1.2 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a certain length-verification error during processing of a DTLS handshake.
No detection rules found.
No public exploits indexed.
https://code.google.com/p/google-security-research/issues/detail?id=202https://github.com/robertbachmann/openbsd-libssl/commit/62a110d447bb8c16a4c69629e28a42e8c39fd7e0https://code.google.com/p/google-security-research/issues/detail?id=202https://github.com/robertbachmann/openbsd-libssl/commit/62a110d447bb8c16a4c69629e28a42e8c39fd7e0
2014-12-29
Published