CVE-2014-2896

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-28979.8The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows reCVE-2014-28989.8wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggersCVE-2014-28995.0wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer cCVE-2014-29005.8wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle aCVE-2014-29017.5wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.CVE-2014-29027.5wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.CVE-2014-29035.9CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certCVE-2014-29047.5wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.CVE-2014-29056.9fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the univeCVE-2014-29067.0The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to executeCVE-2014-29074.3The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly updatCVE-2014-29084.3Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attac
CVE-2014-2896: Critical severity, CVSS 9.8 | Vulnix