CVE-2014-2896

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/oss-sec/2014/q2/126Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2014/q2/130Mailing List, Third Party Advisory
http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.htmlVendor Advisory
http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.htmlVendor Advisory
http://seclists.org/oss-sec/2014/q2/126Mailing List, Third Party Advisory
http://seclists.org/oss-sec/2014/q2/130Mailing List, Third Party Advisory
http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.htmlVendor Advisory
http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.htmlVendor Advisory

Timeline

Published: Jan 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-28979.8The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows re CVE-2014-28989.8wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers CVE-2014-28995.0wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer c CVE-2014-29005.8wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle a CVE-2014-29017.5wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.CVE-2014-29027.5wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.CVE-2014-29035.9CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server cert CVE-2014-29047.5wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.CVE-2014-29056.9fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the unive CVE-2014-29067.0The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute CVE-2014-29074.3The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly updat CVE-2014-29084.3Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attac