CVE-2010-5298: fedoraproject fedora

Modified

AliasesMGASA-2014-0187UBUNTU-CVE-2010-5298DEBIAN-CVE-2010-5298

Published 14-04-2014Last modified 07-08-2024

Vulnerability summary

CVE-2010-5298 is a medium (CVSS 4.0) vulnerability in fedoraproject fedora. EPSS estimates a 34.13% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.0/10

010

Medium · v2.0 (NVD)

EPSS score

34.13%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 3

DSA-2908-1 OPENSUSE-SU-2024:11127-1 RHSA-2014:0625 RHSA-2014:0628 RHSA-2014:0679 SUSE-SU-2015:0743-1+1 more

Timeline

14-04-2014
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

CVSS metrics

1 score · 1 source · 1 version

v2.04.0

EPSS trend

Probability

34.13%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 34.13% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Suse4 products

Mageia2 products

openssl< 1.0.1e-1.7.mga3
openssl< 1.0.1e-8.4.mga4

Debian1 product

openssl< 1.0.1g-3

Fedoraproject1 product

fedoraEOL19 | 20

Mariadb1 product

mariadb≥ 10.0.0, < 10.0.13

Openssl1 product

openssl≤ 1.0.1g

Ubuntu1 product

openssl< 1.0.1f-1ubuntu2.1

7 vendors · 11 products

References

90 links

secunia.com/advisories/59342Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/59669Third Party AdvisoryX Refsource SECUNIANot Applicable
www.securityfocus.com/bid/66801VDB EntryX Refsource BIDThird Party Advisory
marc.info?l=bugtraq&m=140544599631400&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
www.vmware.com/security/advisories/VMSA-2014-0012.htmlX Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676655X Refsource CONFIRMThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676879X Refsource CONFIRMBroken Link
www-01.ibm.com/support/docview.wss?uid=swg21677828X Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=140621259019789&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory

Show all 90 references

secunia.com/advisories/59300Third Party AdvisoryX Refsource SECUNIANot Applicable
security.gentoo.org/glsa/glsa-201407-05.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
rt.openssl.org/Ticket/Display.html?id=3265&user=guest&pass=guestX Refsource MISCBroken Link
www.ibm.com/support/docview.wss?uid=swg24037783X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21677695X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676529X Refsource CONFIRMThird Party Advisory
www.securityfocus.com/archive/1/534161/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www-01.ibm.com/support/docview.wss?uid=swg21676889X Refsource CONFIRMBroken Link
lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2014:090Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/59440Third Party AdvisoryX Refsource SECUNIANot Applicable
www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59655Third Party AdvisoryX Refsource SECUNIANot Applicable
www-01.ibm.com/support/docview.wss?uid=swg21677836X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59437Third Party AdvisoryX Refsource SECUNIANot Applicable
www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754X Refsource CONFIRMBroken Link
www.vmware.com/security/advisories/VMSA-2014-0006.htmlX Refsource CONFIRMThird Party Advisory
www.fortiguard.com/advisory/FG-IR-14-018/X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.ibm.com/support/docview.wss?uid=swg21676356X Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=140389274407904&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
support.citrix.com/article/CTX140876X Refsource CONFIRMThird Party Advisory
svnweb.freebsd.org/ports/head/security/openssl/files/patch-ssl-s3_pkt.c?revision=351191&view=markupX Refsource CONFIRMBroken Link
www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757X Refsource CONFIRMBroken Link
advisories.mageia.org/MGASA-2014-0187.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/58939Third Party AdvisoryX Refsource SECUNIANot Applicable
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-opensslVendor AdvisoryX Refsource CISCOThird Party Advisory
kb.juniper.net/InfoCenter/index?page=content&id=KB29195X Refsource CONFIRMPermissions Required
kc.mcafee.com/corporate/index?page=content&id=SB10075X Refsource CONFIRMBroken Link
www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlX Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676419X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59438Third Party AdvisoryX Refsource SECUNIANot Applicable
marc.info?l=bugtraq&m=141658880509699&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
www.openssl.org/news/secadv_20140605.txtX Refsource CONFIRMThird Party Advisory
seclists.org/fulldisclosure/2014/Dec/23Mailing ListX Refsource FULLDISCThird Party Advisory
secunia.com/advisories/59301Third Party AdvisoryX Refsource SECUNIANot Applicable
kb.bluecoat.com/index?page=content&id=SA80X Refsource CONFIRMBroken Link
marc.info?l=bugtraq&m=140904544427729&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
kb.juniper.net/InfoCenter/index?page=content&id=JSA10629X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21678167X Refsource CONFIRMThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
marc.info?l=bugtraq&m=140752315422991&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
marc.info?l=bugtraq&m=140389355508263&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
marc.info?l=bugtraq&m=140448122410568&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
secunia.com/advisories/59666Third Party AdvisoryX Refsource SECUNIANot Applicable
marc.info?l=bugtraq&m=140431828824371&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
secunia.com/advisories/59413Third Party AdvisoryX Refsource SECUNIANot Applicable
www.openbsd.org/errata55.htmlVendor AdvisoryX Refsource OPENBSDThird Party AdvisoryREPORT
www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlX Refsource CONFIRMThird Party Advisory
ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/004_openssl.patch.sigX Refsource CONFIRMPatchThird Party Advisory
secunia.com/advisories/59721Third Party AdvisoryX Refsource SECUNIANot Applicable
www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756X Refsource CONFIRMBroken Link
www-01.ibm.com/support/docview.wss?uid=swg21676062X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/58713Third Party AdvisoryX Refsource SECUNIANot Applicable
www-01.ibm.com/support/docview.wss?uid=swg21673137X Refsource CONFIRMBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2015:062Vendor AdvisoryX Refsource MANDRIVABroken Link
www-01.ibm.com/support/docview.wss?uid=swg21676035X Refsource CONFIRMBroken Link
secunia.com/advisories/59450Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/59287Third Party AdvisoryX Refsource SECUNIANot Applicable
www-01.ibm.com/support/docview.wss?uid=swg21683332X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/58977Third Party AdvisoryX Refsource SECUNIANot Applicable
www.novell.com/support/kb/doc.php?id=7015271X Refsource CONFIRMThird Party Advisory
www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuseX Refsource MISCThird Party AdvisoryREPORT
rt.openssl.org/Ticket/Display.html?id=2167&user=guest&pass=guestX Refsource MISCBroken Link
www.blackberry.com/btsc/KB36051X Refsource CONFIRMBroken Link
www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755X Refsource CONFIRMBroken Link
www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htmX Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21677527X Refsource CONFIRMBroken Link
secunia.com/advisories/58337Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/59162Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/59490Third Party AdvisoryX Refsource SECUNIANot Applicable
openwall.com/lists/oss-security/2014/04/13/1Mailing ListX Refsource MLISTPatchREPORT
advisories.mageia.org/MGASA-2014-0187.htmlAdvisory
www.debian.org/security/2014/dsa-2908WEB
bugs.mageia.org/show_bug.cgi?id=13210REPORT
ubuntu.com/security/CVE-2010-5298REPORT
openwall.com/lists/oss-security/2014/04/13/2REPORT
ubuntu.com/security/notices/USN-2192-1Advisory
www.cve.org/CVERecord?id=CVE-2010-5298REPORT
security-tracker.debian.org/tracker/CVE-2010-5298Advisory