CVE-2014-3953

Severity: medium (CVSS 4.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-15 · updated 2026-06-17
Weakness: CWE-119

Description

FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via a (1) SCTP_SNDRCV, (2) SCTP_EXTRCV, or (3) SCTP_RCVINFO SCTP cmsg or a (4) SCTP_PEER_ADDR_CHANGE, (5) SCTP_REMOTE_ERROR, or (6) SCTP_AUTHENTICATION_EVENT notification.

Affected products

FreeBSD: 8.4, 9.1, 9.2, 10.0

References

http://secunia.com/advisories/62218
http://www.debian.org/security/2014/dsa-3070
http://www.freebsd.org/security/advisories/FreeBSD-SA-14:17.kmem.asc
http://www.securitytracker.com/id/1030539
http://secunia.com/advisories/62218
http://www.debian.org/security/2014/dsa-3070
http://www.freebsd.org/security/advisories/FreeBSD-SA-14:17.kmem.asc
http://www.securitytracker.com/id/1030539

Get alerted when CVE-2014-3953 or the next vulnerability affects your stack