CVE-2014-3509
openssl: race condition in ssl_parse_serverhello_tlsext
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · August 6, 2014
Updated · November 2, 2026
Description
A race condition was found in the way OpenSSL handled ServerHello messages with an included Supported EC Point Format extension. A malicious server could possibly use this flaw to cause a multi-threaded TLS/SSL client using OpenSSL to write into freed memory, causing the client to crash or execute arbitrary code.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 5.1AV:N/AC:H/Au:N/C:P/I:P/A:P
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization