Vulnerability Details CVE-2014-2898
wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-of-bounds read when an error occurs, related to not checking the return code and MAC verification failure.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.01
EPSS Ranking 75.9%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- http://seclists.org/oss-sec/2014/q2/126
- http://seclists.org/oss-sec/2014/q2/130
- http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html
- http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html
- http://seclists.org/oss-sec/2014/q2/126
- http://seclists.org/oss-sec/2014/q2/130
- http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html
- http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html
Products affected by CVE-2014-2898
-
cpe:2.3:a:wolfssl:wolfssl:-
-
cpe:2.3:a:wolfssl:wolfssl:0.5
-
cpe:2.3:a:wolfssl:wolfssl:1.8.8.0
-
cpe:2.3:a:wolfssl:wolfssl:1.9.0
-
cpe:2.3:a:wolfssl:wolfssl:2.0.2
-
cpe:2.3:a:wolfssl:wolfssl:2.0.3
-
cpe:2.3:a:wolfssl:wolfssl:2.0.6
-
cpe:2.3:a:wolfssl:wolfssl:2.0.8
-
cpe:2.3:a:wolfssl:wolfssl:2.1.1
-
cpe:2.3:a:wolfssl:wolfssl:2.1.2
-
cpe:2.3:a:wolfssl:wolfssl:2.1.4
-
cpe:2.3:a:wolfssl:wolfssl:2.2.0
-
cpe:2.3:a:wolfssl:wolfssl:2.2.1
-
cpe:2.3:a:wolfssl:wolfssl:2.2.2
-
cpe:2.3:a:wolfssl:wolfssl:2.3.0
-
cpe:2.3:a:wolfssl:wolfssl:2.4.0
-
cpe:2.3:a:wolfssl:wolfssl:2.4.2
-
cpe:2.3:a:wolfssl:wolfssl:2.4.6
-
cpe:2.3:a:wolfssl:wolfssl:2.4.7
-
cpe:2.3:a:wolfssl:wolfssl:2.5.0
-
cpe:2.3:a:wolfssl:wolfssl:2.5.2
-
cpe:2.3:a:wolfssl:wolfssl:2.6.0
-
cpe:2.3:a:wolfssl:wolfssl:2.6.2
-
cpe:2.3:a:wolfssl:wolfssl:2.7.0
-
cpe:2.3:a:wolfssl:wolfssl:2.7.2
-
cpe:2.3:a:wolfssl:wolfssl:2.8.0
-
cpe:2.3:a:wolfssl:wolfssl:2.8.2
-
cpe:2.3:a:wolfssl:wolfssl:2.8.3
-
cpe:2.3:a:wolfssl:wolfssl:2.8.4
-
cpe:2.3:a:wolfssl:wolfssl:2.8.5
-
cpe:2.3:a:wolfssl:wolfssl:2.8.6