CVE-2010-3864: openssl
Vulnerability summary
CVE-2010-3864 is a high (CVSS 7.6) vulnerability in openssl. EPSS estimates a 22.14% chance of exploitation in the next 30 days, higher than 97.6% of scored vulnerabilities.
Not severe (CVSS 7.6, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 17-11-2010PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
22.14%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 22.14% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat5 products
- openssl< 0:1.0.0-4.el6_0.1
- openssl-debuginfo< 0:1.0.0-4.el6_0.1
- openssl-devel< 0:1.0.0-4.el6_0.1
- openssl-perl< 0:1.0.0-4.el6_0.1
- openssl-static< 0:1.0.0-4.el6_0.1
Debian1 product
- openssl< 0.9.8g-15+lenny9 | < 0.9.8o-3
Openssl1 product
- opensslEOL0.9.8f | 0.9.8g | 0.9.8h | 0.9.8i | 0.9.8j | 0.9.8k | 0.9.8l | 0.9.8m | 0.9.8n | 0.9.8o | 1.0.0 | 1.0.0a
3 vendors · 7 products
References
46 links- lists.fedoraproject.org/pipermail/package-announce/2010-November/051170.htmlVendor AdvisoryX Refsource FEDORA
- slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668793Vendor AdvisoryX Refsource SLACKWARE
- www-01.ibm.com/support/docview.wss?uid=ssg1S1004564X Refsource CONFIRM
- support.apple.com/kb/HT4723X Refsource CONFIRM
- blogs.sun.com/security/entry/cve_2010_3864_race_conditionX Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2010-November/051255.htmlVendor AdvisoryX Refsource FEDORA
Show all 46 references
- lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.htmlMailing ListX Refsource MLIST
- lists.fedoraproject.org/pipermail/package-announce/2010-November/051237.htmlVendor AdvisoryX Refsource FEDORA
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777Vendor AdvisoryX Refsource HP
- lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.htmlMailing ListX Refsource MLIST
- www.adobe.com/support/security/bulletins/apsb11-11.htmlX Refsource CONFIRM
- www.vmware.com/security/advisories/VMSA-2011-0003.htmlX Refsource CONFIRM
