CVE-2010-5298

OpenSSL < 1.0.1g - Use-After-Free and Denial of Service via Multithreaded SSL Connection

Title source: llm

Description

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

References (82)

Core 82

Core References

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59342

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59669

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/66801

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=140544599631400&w=2

Third Party Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21676655

Third Party Advisory x_refsource_confirm

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946

Broken Link x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21676879

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21677828

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=140621259019789&w=2

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59300

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-201407-05.xml

Broken Link x_refsource_misc

https://rt.openssl.org/Ticket/Display.html?id=3265&user=guest&pass=guest

Third Party Advisory x_refsource_confirm

http://www.ibm.com/support/docview.wss?uid=swg24037783

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21677695

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21676529

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Broken Link x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21676889

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

Broken Link vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2014:090

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59440

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59655

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21677836

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59437

Broken Link x_refsource_confirm

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754

Third Party Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2014-0006.html

Third Party Advisory x_refsource_confirm

http://www.fortiguard.com/advisory/FG-IR-14-018/

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html

Third Party Advisory x_refsource_confirm

http://www.ibm.com/support/docview.wss?uid=swg21676356

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=140389274407904&w=2

Third Party Advisory x_refsource_confirm

http://support.citrix.com/article/CTX140876

Broken Link x_refsource_confirm

http://svnweb.freebsd.org/ports/head/security/openssl/files/patch-ssl-s3_pkt.c?revision=351191&view=markup

Broken Link x_refsource_confirm

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757

Third Party Advisory x_refsource_confirm

http://advisories.mageia.org/MGASA-2014-0187.html

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58939

Third Party Advisory vendor-advisory x_refsource_cisco

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl

Permissions Required x_refsource_confirm

http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195

Broken Link x_refsource_confirm

https://kc.mcafee.com/corporate/index?page=content&id=SB10075

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21676419

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59438

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=141658880509699&w=2

Third Party Advisory x_refsource_confirm

http://www.openssl.org/news/secadv_20140605.txt

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2014/Dec/23

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59301

Broken Link x_refsource_confirm

https://kb.bluecoat.com/index?page=content&id=SA80

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=140904544427729&w=2

Third Party Advisory x_refsource_confirm

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21678167

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=140752315422991&w=2

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=140389355508263&w=2

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=140448122410568&w=2

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59666

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=140431828824371&w=2

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59413

Third Party Advisory vendor-advisory x_refsource_openbsd

http://www.openbsd.org/errata55.html#004_openssl

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Patch, Third Party Advisory x_refsource_confirm

http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/004_openssl.patch.sig

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59721

Broken Link x_refsource_confirm

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21676062

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58713

Broken Link x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21673137

Broken Link vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2015:062

Broken Link x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21676035

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59450

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59287

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21683332

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58977

Third Party Advisory x_refsource_confirm

https://www.novell.com/support/kb/doc.php?id=7015271

Third Party Advisory x_refsource_misc

http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse

Broken Link x_refsource_misc

https://rt.openssl.org/Ticket/Display.html?id=2167&user=guest&pass=guest

Broken Link x_refsource_confirm

http://www.blackberry.com/btsc/KB36051

Broken Link x_refsource_confirm

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755

Third Party Advisory x_refsource_confirm

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm

Broken Link x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21677527

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58337

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59162

Not Applicable third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59490

Mailing List, Patch mailing-list x_refsource_mlist

http://openwall.com/lists/oss-security/2014/04/13/1

Scores

EPSS 0.1470

EPSS Percentile 94.6%

Details

CWE

CWE-362

Status published

Products (8)

fedoraproject/fedora 19

fedoraproject/fedora 20

mariadb/mariadb 10.0.0 - 10.0.13

openssl/openssl < 1.0.1g

suse/linux_enterprise_desktop 12

suse/linux_enterprise_server 12

suse/linux_enterprise_software_development_kit 12

suse/linux_enterprise_workstation_extension 12

Published Apr 14, 2014

Tracked Since Feb 18, 2026