CVE-2014-0195
MEDIUM · CVSS 6.8EPSS 100.0%EU EUVD
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.
Key facts
- CVSS score
- 6.8 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:M/Au:N/C:P/I:P/A:P- Weakness (CWE)
- CWE-120
- EPSS score
- 100.0% (100th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2014-0246)
- Published
- June 5, 2014
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2014-0246 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- fedoraproject / fedora
- fedoraproject / fedora
- mariadb / mariadb
- openssl / openssl
- opensuse / leap
- opensuse / opensuse
References
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc(Third Party Advisory)
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048(Broken Link)
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002(Broken Link)
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629(Third Party Advisory)
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html(Mailing List, Third Party Advisory)
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html(Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140266410314613&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140317760000786&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140389274407904&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140389355508263&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140431828824371&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140448122410568&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140482916501310&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140491231331543&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140499827729550&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140621259019789&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140752315422991&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=140904544427729&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=142660345230545&w=2(Issue Tracking, Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2014/Dec/23(Mailing List, Third Party Advisory)
- http://secunia.com/advisories/58337(Not Applicable)
- http://secunia.com/advisories/58615(Not Applicable)
- http://secunia.com/advisories/58660(Not Applicable)
- http://secunia.com/advisories/58713(Not Applicable)
- http://secunia.com/advisories/58714(Not Applicable)
- http://secunia.com/advisories/58743(Not Applicable)
- http://secunia.com/advisories/58883(Not Applicable)
- http://secunia.com/advisories/58939(Not Applicable)
- http://secunia.com/advisories/58945(Not Applicable)
- http://secunia.com/advisories/58977(Not Applicable)
- http://secunia.com/advisories/59040(Not Applicable)
- http://secunia.com/advisories/59126(Not Applicable)
- http://secunia.com/advisories/59162(Not Applicable)
- http://secunia.com/advisories/59175(Not Applicable)
- http://secunia.com/advisories/59188(Not Applicable)
- http://secunia.com/advisories/59189(Not Applicable)
- http://secunia.com/advisories/59192(Not Applicable)
- http://secunia.com/advisories/59223(Not Applicable)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain