CVE-2014-3509

Publication date 7 August 2014

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.

Status

Package Ubuntu Release Status
openssl 14.04 LTS trusty
Fixed 1.0.1f-1ubuntu2.5
12.04 LTS precise
Fixed 1.0.1-4ubuntu5.17
10.04 LTS lucid
Not affected
openssl098 14.04 LTS trusty Not in release
12.04 LTS precise
Not affected
10.04 LTS lucid Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
openssl

References

Related Ubuntu Security Notices (USN)

    • USN-2308-1
    • OpenSSL vulnerabilities
    • 7 August 2014

Other references