CVE-2014-3505: Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 be...

Security readout for executives and security teams

CVE-2014-3505 is an OpenSSL DTLS flaw that can let a remote attacker crash affected applications. The issue is a denial-of-service risk, not a disclosed data theft or code execution issue in the provided sources. Business impact depends on whether vulnerable OpenSSL DTLS services are exposed and availability-critical. Exposure is most likely on servers, appliances, or applications using affected OpenSSL versions with DTLS reachable by untrusted networks. TLS-only services that do not use DTLS are less directly exposed. Vendor-packaged products may require checking their advisories rather than only local library versions. Treat this as a moderate availability risk. It should be remediated in normal patch cycles, with faster action for internet-facing DTLS services, VPN-like services, and products where a crash would disrupt business operations. Mitigation focus: Upgrade OpenSSL to 0.9.8zb, 1.0.0n, 1.0.1i, or later supported releases.; Apply operating system vendor updates from Red Hat, SUSE, Oracle, Gentoo, or relevant product vendors.; Prioritize externally reachable DTLS services and availability-critical systems..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.