CVE-2014-3000
Last modified
CVE-2014-3000 is a vulnerability of currently unknown severity. The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full.. EPSS estimates a 12.82% chance of exploitation in the next 30 days.
Description
The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Freebsd | Freebsd | 8.3 |
| Freebsd | Freebsd | 8.4 |
| Freebsd | Freebsd | 9.1 |
| Freebsd | Freebsd | 9.2 |
| Freebsd | Freebsd | 10.0 |
References
- http://secunia.com/advisories/58293Vendor Advisory
- http://secunia.com/advisories/58293Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-3000?
How severe is CVE-2014-3000?
How do I fix CVE-2014-3000?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-2989Cross-site request forgery (CSRF) vulnerability in Open Asse…
- CVE-2014-2992The Misli.com application for Android does not verify X.509 …
- CVE-2014-2993The Birebin.com application for Android does not verify X.50…
- CVE-2014-2994Stack-based buffer overflow in Acunetix Web Vulnerability Sc…
- CVE-2014-2995Multiple cross-site scripting (XSS) vulnerabilities in twitg…
- CVE-2014-2996XCloner Standalone 3.5 and earlier, when enable_db_backup an…
- CVE-2014-3001The device file system (aka devfs) in FreeBSD 10.0 before p2…
- CVE-2014-3003Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2014-3004The default configuration for the Xerces SAX Parser in Casto…
- CVE-2014-3005XML external entity (XXE) vulnerability in Zabbix 1.8.x befo…
- CVE-2014-3006Sitepark Information Enterprise Server (IES) 2.9 before 2.9.…
- CVE-2014-3007Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 …
Are you affected by CVE-2014-3000?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST