Design/Logic Flaw

An issue was discovered in Samsung TizenRT through 3.0GBM and 3.1PRE. cyasslconnectstep2 in curl/vtls/cyassl.c has a missing X509free after SSLgetpeercertificate, leading to information disclosure...

UBUNTU-CVE-2022-40281

An issue was discovered in Samsung TizenRT through 3.0GBM and 3.1PRE. cyasslconnectstep2 in curl/vtls/cyassl.c has a missing X509free after SSLgetpeercertificate, leading to information disclosure...

CVE-2022-40281

CVE-2022-40281 affects Samsung TizenRT versions up to 3.0_GBM and 3.1_PRE. The issue is in cyassl_connect_step2 (curl/vtls/cyassl.c) where an X509_free call after SSL_get_peer_certificate is missing, causing information disclosure. Connected sources (e.g., PT-2022-25320) describe the vulnerable r...

wolfSSL buffer overflow vulnerability (CNVD-2020-13495)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A buffer overflow vulnerability exists in wolfSSL CyaSSL versions prior to 2.9.4. The vulnerability stems from a networked system or...

wolfSSL buffer overflow vulnerability (CNVD-2020-13496)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. wolfSSL A buffer overflow vulnerability exists in the 'DoAlert' function in versions of CyaSSL prior to 2.9.4. The vulnerability stems...

CVE-2014-2898

wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSLread function which triggers an out-of-bounds read when an error occurs, related to not checking the return code and MAC verification failure...

CVE-2014-2897

The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote attackers to have unspecified impact via a crafted HMAC, which triggers an out-of-bounds read...

Out-of-bounds

The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote attackers to have unspecified impact via a crafted HMAC, which triggers an out-of-bounds read...

Memory corruption

The DoAlert function in the 1 TLS and 2 DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read...

Out-of-bounds

wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSLread function which triggers an out-of-bounds read when an error occurs, related to not checking the return code and MAC verification failure...

CVE-2014-2898

wolfSSL CyaSSL before 2.9.4 is affected by an out-of-bounds read in CyaSSL_read triggered when an error occurs, due to not checking the return code and MAC verification failure. Vulnerable component: CyaSSL_read (wolfSSL/CyaSSL). Impact: remote attackers could cause unspecified effects; the CVE n...

CVE-2014-2898

wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSLread function which triggers an out-of-bounds read when an error occurs, related to not checking the return code and MAC verification failure...

CVE-2014-2897

The CVE-2014-2897 issue affects wolfSSL/CyaSSL 2.5.0 prior to 2.9.4 where the SSL 3 HMAC padding length is not checked on verification, enabling a remote attacker to trigger an out-of-bounds read via a crafted HMAC. This is a network-accessible vulnerability with potential confidentiality, integr...

CVE-2014-2896

The DoAlert function in wolfSSL/CyaSSL TLS and DTLS implementations is affected by CVE-2014-2896 prior to version 2.9.4. The vulnerability allows remote attackers to trigger memory corruption or an out-of-bounds read over the network, with the impact described as unspecified in the primary entry....

CVE-2014-2896

The DoAlert function in the 1 TLS and 2 DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read...

WolfSSL CyaSSL Certificate Validation Bypass Vulnerability

WolfSSL CyaSSL is the United States WolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A certificate validation bypass vulnerability exists in WolfSSL CyaSSL. A remote attacker can exploit this vulnerability to spoof a server with a speciall...

Design/Logic Flaw

CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake...

CVE-2014-2903

CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake...

DEBIAN-CVE-2014-2903

CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake...

CVE-2014-2903

CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake...