UBUNTU-CVE-2010-5298
See a problem?- Source
- https://ubuntu.com/security/notices/UBUNTU-CVE-2010-5298
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2010/UBUNTU-CVE-2010-5298.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2010-5298
- Related
- Published
- 2014-04-14T00:00:00Z
- Modified
- 2014-04-14T00:00:00Z
- Summary
- [none]
- Details
-
Race condition in the ssl3readbytes function in s3pkt.c in OpenSSL through 1.0.1g, when SSLMODERELEASEBUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.
- References
-
- https://ubuntu.com/security/CVE-2010-5298
- http://openwall.com/lists/oss-security/2014/04/13/1
- http://openwall.com/lists/oss-security/2014/04/13/2
- http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse
- http://www.openbsd.org/errata55.html#004_openssl
- https://ubuntu.com/security/notices/USN-2192-1
- https://www.cve.org/CVERecord?id=CVE-2010-5298
Affected packages
Ubuntu:14.04:LTS / openssl
Package
- Name
- openssl
- Purl
- pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.1?arch=src?distro=trusty
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.0.1f-1ubuntu2.1
Affected versions
1.*
1.0.1e-3ubuntu1
1.0.1e-4ubuntu1
1.0.1e-4ubuntu2
1.0.1e-4ubuntu3
1.0.1e-4ubuntu4
1.0.1f-1ubuntu1
1.0.1f-1ubuntu2
Ecosystem specific
{
"availability": "No subscription required",
"ubuntu_priority": "low",
"binaries": [
{
"libssl-dev": "1.0.1f-1ubuntu2.1",
"libssl-doc": "1.0.1f-1ubuntu2.1",
"libssl1.0.0-dbg": "1.0.1f-1ubuntu2.1",
"openssl": "1.0.1f-1ubuntu2.1",
"libssl1.0.0-udeb": "1.0.1f-1ubuntu2.1",
"libssl1.0.0": "1.0.1f-1ubuntu2.1",
"libcrypto1.0.0-udeb": "1.0.1f-1ubuntu2.1"
}
]
}