CVE-2014-8564

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-updates/2014-11/msg00084.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1846.htmlThird Party Advisory
http://secunia.com/advisories/59991
http://secunia.com/advisories/62284
http://secunia.com/advisories/62294
http://www.ubuntu.com/usn/USN-2403-1Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1161443Issue Tracking
http://lists.opensuse.org/opensuse-updates/2014-11/msg00084.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1846.htmlThird Party Advisory
http://secunia.com/advisories/59991
http://secunia.com/advisories/62284
http://secunia.com/advisories/62294
http://www.ubuntu.com/usn/USN-2403-1Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1161443Issue Tracking

Timeline

Published: Nov 13, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-85666.4The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation f CVE-2014-85679.4The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout CVE-2014-85705.3Huawei S9300, S9303, S9306, S9312 with software V100R002; S7700, S7703, S7706, S7712 with software V100R003, V100R006, V200R001, V200R002, V CVE-2014-85713.3Apps on Huawei Ascend P6 mobile phones with software EDGE-U00 V100R001C17B508SP01 and earlier versions before V100R001C17B508SP02; EDGE-T00 CVE-2014-85727.5Huawei AC6605 with software V200R001C00; AC6605 with software V200R002C00; ACU with software V200R001C00; ACU with software V200R002C00; S23 CVE-2014-85774.3Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via CVE-2014-85783.5Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and J CVE-2014-85799.8TRENDnet TEW-823DRU devices with firmware before 1.00b36 have a hardcoded password of kcodeskcodes for the root account, which makes it easi CVE-2014-85804.9Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52.11, 10.1.122.17 before 10.1-129.11, and 10.CVE-2014-85826.4FortiNet FortiADC-E with firmware 3.1.1 before 4.0.5 and Coyote Point Equalizer with firmware 10.2.0a allows remote attackers to obtain acce CVE-2014-85836.9mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, wh CVE-2014-85844.3Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPres