CVE-2010-5298
Summary
| CVE | CVE-2010-5298 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-04-14 22:38:08 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
PartialAV:N/AC:H/Au:N/C:N/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 19 | All | All | All |
| Operating System | Fedoraproject | Fedora | 20 | All | All | All |
| Application | Mariadb | Mariadb | All | All | All | All |
| Application | Openssl | Openssl | All | All | All | All |
| Operating System | Suse | Linux Enterprise Desktop | 12 | - | All | All |
| Operating System | Suse | Linux Enterprise Server | 12 | - | All | All |
| Operating System | Suse | Linux Enterprise Software Development Kit | 12 | - | All | All |
| Operating System | Suse | Linux Enterprise Workstation Extension | 12 | - | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM Support | af854a3a-2127-422b-91ae-364da2661108 | www-947.ibm.com | Broken Link |
| IBM Support | af854a3a-2127-422b-91ae-364da2661108 | www-947.ibm.com | Broken Link |
| IBM Security Bulletin: IBM® SDK for Node.js™ is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| analysis of openssl freelist reuse | af854a3a-2127-422b-91ae-364da2661108 | www.tedunangst.com | Third Party Advisory |
| Security Bulletin: Rational Application Developer is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 | af854a3a-2127-422b-91ae-364da2661108 | www.ibm.com | Third Party Advisory |
| www.novell.com/support/kb/doc.php | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | Third Party Advisory |
| IBM Support | af854a3a-2127-422b-91ae-364da2661108 | www-947.ibm.com | Broken Link |
| IBM Support | af854a3a-2127-422b-91ae-364da2661108 | www-947.ibm.com | Broken Link |
| #2167: openssl-1.0.0-beta5 - fails if used from multiple threads and with SSL_MODE_RELEASE_BUFFERS | af854a3a-2127-422b-91ae-364da2661108 | rt.openssl.org | Broken Link |
| IBM Security Bulletin: IBM Sterling Connect:Express for UNIX is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| Mageia Advisory: MGASA-2014-0187 - Updated openssl packages fix CVE-2010-5298 | af854a3a-2127-422b-91ae-364da2661108 | advisories.mageia.org | Third Party Advisory |
| kb.bluecoat.com/index | af854a3a-2127-422b-91ae-364da2661108 | kb.bluecoat.com | Broken Link |
| IBM notice: The page you requested cannot be displayed | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Broken Link |
| Security Advisory-Multiple OpenSSL vulnerabilities on Huawei products - Huawei PSIRT | af854a3a-2127-422b-91ae-364da2661108 | www.huawei.com | Third Party Advisory |
| Security Advisory SA59669 - IBM InfoSphere Guardium OpenSSL Security Issue and Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Security Advisory SA58939 - IBM SmartCloud Orchestrator OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| [SECURITY] Fedora 19 Update: openssl-1.0.1e-39.fc19 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | Mailing List, Third Party Advisory |
| '[security bulletin] HPSBMU03055 rev.1 - HP Smart Update Manager (HP SUM) running OpenSSL, Remote Den' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| Multiple Vulnerabilities in OpenSSL Affecting Cisco Products | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Third Party Advisory |
| ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/004_openssl.patch.sig | af854a3a-2127-422b-91ae-364da2661108 | ftp.openbsd.org | Patch, Third Party Advisory |
| Oracle Critical Patch Update - October 2014 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| '[security bulletin] HPSBGN03068 rev.1 - HP OneView running OpenSSL, Remote Denial of Service (DoS), ' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| '[security bulletin] HPSBMU03057 rev.1 - HP Version Control Agent (HP VCA) running OpenSSL on Linux a' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| Security Advisory SA59440 - IBM Security Network Protection Security Issue and Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| mandriva.com | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | Broken Link |
| Security Advisory SA59666 - IBM SDK for Node.js OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| IBM Security Bulletin: IBM InfoSphere Guardium Database Activity Monitor is affected by CVE-2014-0221, CVE-2014-0224, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| Security Advisory SA59300 - IBM Tivoli Management Framework OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| IBM Security Bulletin: IBM Security Network Protection is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| Security Advisory SA59162 - McAfee Multiple Products OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM SmartCloud Provisioning. - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| IBM Security Bulletin: SmartCloud Orchestrator is affected by the following OpenSSL vulnerabilities (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0076) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| '[security bulletin] HPSBMU03051 rev.2 - HP System Management Homepage running OpenSSL on Linux and W' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| Gentoo Linux Documentation -- OpenSSL: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | Third Party Advisory |
| VMSA-2014-0006.11 | United States | af854a3a-2127-422b-91ae-364da2661108 | www.vmware.com | Third Party Advisory |
| IBM Security Bulletin: IBM Initiate Master Data Service, IBM InfoSphere Master Data Management are affected by the following OpenSSL vulnerabilities: (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 and CVE-2014-0076) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| '[security bulletin] HPSBHF03052 rev.2 - HP Network Products running OpenSSL, Multiple Remote Vulnera' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| Oracle Critical Patch Update - July 2014 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| IBM Security Bulletin: IBM Security Access Manager for Mobile and IBM Security Access Manager for Web appliances are affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 and possibly CVE-2014-0076 - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| Juniper Networks - Junos Pulse/SA (SSLVPN): Details on fixes for SSL/TLS MITM vulnerability (CVE-2014-0224)/JSA10629 - Knowledge Base | af854a3a-2127-422b-91ae-364da2661108 | kb.juniper.net | Permissions Required |
| IBM Security Bulletin: IBM Security Network Intrusion Prevention System is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, and CVE-2014-3470. - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Broken Link |
| ViewVC Exception | af854a3a-2127-422b-91ae-364da2661108 | svnweb.freebsd.org | Broken Link |
| Document Display | HPE Support Center | af854a3a-2127-422b-91ae-364da2661108 | h20566.www2.hpe.com | Third Party Advisory |
| Citrix Security Advisory for OpenSSL Vulnerabilities (June 2014) | af854a3a-2127-422b-91ae-364da2661108 | support.citrix.com | Third Party Advisory |
| IBM notice: The page you requested cannot be displayed | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Broken Link |
| [SECURITY] Fedora 20 Update: openssl-1.0.1e-39.fc20 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | Mailing List, Third Party Advisory |
| IBM Security Bulletin: IBM Security Proventia Network Enterprise Scanner is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Broken Link |
| Security Advisory SA58337 - IBM Upward Integration Modules (UIM) OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| www.blackberry.com/btsc/KB36051 | af854a3a-2127-422b-91ae-364da2661108 | www.blackberry.com | Broken Link |
| '[security bulletin] HPSBMU03074 rev.1 - HP Insight Control server migration on Linux and Windows run' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| Support / Security / Advisories / / MDVSA-2015:062 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | Broken Link |
| Security Advisory SA59721 - IBM SmartCloud Provisioning OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Security Advisory SA59450 - IBM API Management OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| IBM Security Bulletin: Tivoli Management Framework is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 and possibly CVE-2014-0076. - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| '[security bulletin] HPSBMU03056 rev.1 - HP Version Control Repository Manager (HP VCRM) running Open' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| OpenBSD 5.5 errata | af854a3a-2127-422b-91ae-364da2661108 | www.openbsd.org | Third Party Advisory |
| Security Advisory SA59342 - HP Smart Update Manager (HP SUM) OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| McAfee KnowledgeBase - McAfee Security Bulletin – Seven OpenSSL vulnerabilities patched in McAfee products | af854a3a-2127-422b-91ae-364da2661108 | kc.mcafee.com | Broken Link |
| Security Advisory SA59655 - IBM SmartCloud Provisioning for IBM Provided Software Virtual Appliance OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Security Advisory SA58713 - IBM Multiple Products OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Security Advisory SA59437 - IBM Rational Application Developer for WebSphere Software OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| IBM SDK for Node.js 1.1.0.4 for use by the Cordova tools | af854a3a-2127-422b-91ae-364da2661108 | www.ibm.com | Third Party Advisory |
| Security Advisory SA59438 - IBM Security Access Manager for Web / Security Access Manager for Mobile Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| '[security bulletin] HPSBMU03076 rev.2 - HP Systems Insight Manager (SIM) on Linux and Windows runnin' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| IBM notice: The page you requested cannot be displayed | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Broken Link |
| '[security bulletin] HPSBMU03062 rev.1 - HP Insight Control server deployment on Linux and Windows ru' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| Security Advisory SA59490 - HP Version Control Agent OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Oracle Critical Patch Update - January 2015 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| oss-security - Use-after-free race condition,in OpenSSL's read buffer | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | Mailing List, Patch |
| www.openssl.org/news/secadv_20140605.txt | af854a3a-2127-422b-91ae-364da2661108 | www.openssl.org | Third Party Advisory |
| Full Disclosure: NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Mailing List, Third Party Advisory |
| FortiGuard.com | Multiple Vulnerabilities in OpenSSL | af854a3a-2127-422b-91ae-364da2661108 | www.fortiguard.com | Third Party Advisory |
| #2167: openssl-1.0.0-beta5 - fails if used from multiple threads and with SSL_MODE_RELEASE_BUFFERS | af854a3a-2127-422b-91ae-364da2661108 | rt.openssl.org | Broken Link |
| Security Advisory SA59287 - IBM Proventia Network Enterprise Scanner OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Security Advisory SA58977 - IBM BladeCenter Advanced Management Module Firmware OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Security Advisory SA59413 - IBM Initiate Master Data Service / IBM InfoSphere Master Data Management OpenSSL Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| Juniper Networks - 2014-06 Out of Cycle Security Bulletin: Vulnerabilities in OpenSSL related to ChangeCipherSpec, DTLS, SSL_MODE_RELEASE_BUFFERS and ECDH ciphersuites - Knowledge Base | af854a3a-2127-422b-91ae-364da2661108 | kb.juniper.net | Third Party Advisory |
| Security Advisory SA59301 - HP Version Control Repository Manager (VCRM) OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Not Applicable |
| VMSA-2014-0012 | United States | af854a3a-2127-422b-91ae-364da2661108 | www.vmware.com | Third Party Advisory |
| [security-announce] SUSE-SU-2015:0743-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Mailing List, Third Party Advisory |
| OpenSSL 'ssl3_release_read_buffer()' Use-After-Free Memory Corruption Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 390226 Oracle Managed Virtualization (VM) Server for x86 Security Update for Open Secure Sockets Layer (OpenSSL) (OVMSA-2021-0011)
- 390284 Oracle Managed Virtualization (VM) Server for x86 Security Update for Open Secure Sockets Layer (OpenSSL) (OVMSA-2023-0013)
- 590349 Rockwell Automation Stratix 5900 Multiple Vulnerabilities (ICSA-17-094-04)
- 591311 Bosch Rexroth PRA-ES8P2S Ethernet-Switch Multiple Vulnerabilities (BOSCH-SA-247053-BT)