The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za 1.0.0 before 1.0.0m and 1.0.1 before 1.0.1h when an anonymous ECDH cipher suite is used allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.