VULNERABILITY INTELLIGENCE
CVE-2010-5298
CVSS score4 MEDIUM
EPSS probability34.13%
CISA KEVNot currently listed
Published2014-04-14
Last modified2026-06-16
CVSS vectorAV:N/AC:H/Au:N/C:N/I:P/A:P
Description
Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.
Weakness classification
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Primary references
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Patch, Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Permissions Required
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory