CVE-2014-9221

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-19

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153825.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-01/msg00054.htmlThird Party Advisory
http://secunia.com/advisories/62071Permissions Required, Third Party Advisory
http://secunia.com/advisories/62083
http://secunia.com/advisories/62095Permissions Required, Third Party Advisory
http://secunia.com/advisories/62663Permissions Required, Third Party Advisory
http://strongswan.org/blog/2015/01/05/strongswan-5.2.2-released.htmlVendor Advisory
http://strongswan.org/blog/2015/01/05/strongswan-denial-of-service-vulnerability-%28cve-2014-9221%29.html
http://www.debian.org/security/2015/dsa-3118Third Party Advisory
http://www.securityfocus.com/bid/71894
http://www.ubuntu.com/usn/USN-2450-1Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153825.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-01/msg00054.htmlThird Party Advisory
http://secunia.com/advisories/62071Permissions Required, Third Party Advisory
http://secunia.com/advisories/62083
http://secunia.com/advisories/62095Permissions Required, Third Party Advisory
http://secunia.com/advisories/62663Permissions Required, Third Party Advisory
http://strongswan.org/blog/2015/01/05/strongswan-5.2.2-released.htmlVendor Advisory
http://strongswan.org/blog/2015/01/05/strongswan-denial-of-service-vulnerability-%28cve-2014-9221%29.html
http://www.debian.org/security/2015/dsa-3118Third Party Advisory
http://www.securityfocus.com/bid/71894
http://www.ubuntu.com/usn/USN-2450-1Third Party Advisory

Timeline

Published: Jan 7, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-922210.0AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to ga CVE-2014-922310.0Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote atta CVE-2014-92243.5Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critic CVE-2014-92254.0The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Securi CVE-2014-92267.2The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SD CVE-2014-92274.4Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow local user CVE-2014-92284.9sysplant.sys in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allows local users to cause a denial of service (b CVE-2014-92296.5Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 CVE-2014-92304.3Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 1 CVE-2014-92345.0Directory traversal vulnerability in cgi-bin/sddownload.cgi in D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to read CVE-2014-92356.5Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arb CVE-2014-92364.3Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attacker