CRITICAL🇵🇱 Wersja polska

CVE-2019-14431

CVSS 9.8v3.1pub. 2019-07-29upd. 2024-11-21

In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and possible Remote Code Execution in parseSSLHandshake in sslDecode.c. During processing of a crafted packet, the server mishandles the fragment length value provided in the DTLS message.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Matrixssl

    APP
    Matrixssl
    3.8.2 – 4.2.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEXSSMemory
CWE
References

Related vulnerabilities

CVE-2019-13470CRITICAL9.8PL ✓same product

MatrixSSL: odczyt poza granicami bufora podczas przetwarzania ASN.1

CVE-2019-10914CRITICAL9.8PL ✓same product

Stack-based buffer overflow w MatrixSSL podczas weryfikacji certyfikatu X.509

CVE-2017-2780CRITICAL9.8PL ✓same product

Heap buffer overflow w parsowaniu certyfikatów X.509 w MatrixSSL

CVE-2017-2781CRITICAL9.8PL ✓same product

Przepełnienie bufora heap w parsowaniu certyfikatów X509 w MatrixSSL

CVE-2016-6890CRITICAL9.8PL ✓same product

Heap-based buffer overflow w MatrixSSL via pole Subject Alt Name certyfikatu X.509