CVE-2010-5298: Use After Free
Race condition in the ssl3readbytes function in s3pkt.c in OpenSSL through 1.0.1g, when SSLMODERELEASEBUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-5298?
CVE-2010-5298 has a moderate severity level due to its potential for data injection and denial of service in multithreaded environments.
How do I fix CVE-2010-5298?
To fix CVE-2010-5298, upgrade OpenSSL to version 1.0.1h or later and ensure that SSL_MODE_RELEASE_BUFFERS is not enabled.
What are the affected versions in CVE-2010-5298?
CVE-2010-5298 affects OpenSSL through version 1.0.1g and several specific versions of MariaDB and SUSE products.
Can CVE-2010-5298 be exploited remotely?
Yes, CVE-2010-5298 can be exploited remotely by attackers making use of vulnerable SSL connections.
What is the primary impact of CVE-2010-5298?
The primary impact of CVE-2010-5298 includes the ability to inject data across sessions and potential denial of service via use-after-free errors.