OpenSSL CVE-2014-0160 Out of Bounds Read Vulnerability

Description

A missing bounds check in the handling of the TLS heartbeat extension can beused to reveal up to 64k of memory to a connected client or server.Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including1.0.1f and 1.0.2-beta1.Thanks for Neel Mehta of Google Security for discovering this bug and toAdam Langley and Bodo Moeller forpreparing the fix.Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediatelyupgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.1.0.2 will be fixed in 1.0.2-beta2.

Affected Applications

OpenSSL

CVE References

Other References