What is CVE-2014-0195?

CVE-2014-0195 is a vulnerability in Mariadb, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). Published 2014-06-05.

Is CVE-2014-0195 known to be exploited?

15 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Mariadb

CVE-2014-0195

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Vulnerability class: Buffer Overflow

Published 2014-06-05 · last modified 2026-06-17.

CVSS v2 metric

CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 1.000 (100.0th percentile), scored 2026-10-16.

Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 1.000 · newest: 1.000 · change: 0.000

Affected products

Mariadb
OpenSSL
Fedoraproject Fedora — versions 19, 20
openSUSE Leap — versions 42.1
openSUSE — versions 13.2

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

Public proof-of-concept exploits

References

secunia.com/advisories/59342 (Not Applicable, third-party-advisory)
secunia.com/advisories/59669 (Not Applicable, third-party-advisory)
secunia.com/advisories/59530 (Not Applicable, third-party-advisory)
secunia.com/advisories/59990 (Not Applicable, third-party-advisory)
www.securitytracker.com/id/1030337 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
secunia.com/advisories/59454 (Not Applicable, third-party-advisory)
secunia.com/advisories/59188 (Not Applicable, third-party-advisory)
secunia.com/advisories/59126 (Not Applicable, third-party-advisory)
secunia.com/advisories/59306 (Not Applicable, third-party-advisory)
www-01.ibm.com/support/docview.wss (Third Party Advisory)

Frequently asked questions

What is CVE-2014-0195?: CVE-2014-0195 is a vulnerability in Mariadb, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). Published 2014-06-05.
Is CVE-2014-0195 known to be exploited?: 15 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.