Homepage

Race Condition The advisory has been revoked - it doesn't affect any version of package openssl  (opens in a new tab)

Threat Intelligence

EPSS
34.13% (99th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-OPENSSL-374592
  • published14 Apr 2014
  • disclosed14 Apr 2014
Report a new vulnerability Found a mistake?

Introduced: 14 Apr 2014

CVE-2010-5298  (opens in a new tab)
CWE-362  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:14.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu.

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

References