4.3

CVE-2010-2939

EPSS 10.27%
Veröffentlicht 17.08.2010 20:00:03
Zuletzt bearbeitet 29.04.2026 01:13:23
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted private key with an invalid prime.  NOTE: some sources refer to this as a use-after-free issue.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 25

NVD 3 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

OpenSSL ≫ OpenSSL Version0.9.7

OpenSSL ≫ OpenSSL Version0.9.8

OpenSSL ≫ OpenSSL Version1.0.0a

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	10.27%	0.928

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:N/A:P

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://www.securityfocus.com/archive/1/516397/100/0/threaded

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html

http://www.ubuntu.com/usn/USN-1003-1

http://marc.info/?l=bugtraq&m=130331363227777&w=2

http://seclists.org/fulldisclosure/2010/Aug/84

http://secunia.com/advisories/40906

Vendor Advisory

http://secunia.com/advisories/41105

http://secunia.com/advisories/42309

http://secunia.com/advisories/42413

http://secunia.com/advisories/43312

http://security.FreeBSD.org/advisories/FreeBSD-SA-10:10.openssl.asc

http://securitytracker.com/id?1024296

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668793

http://www.debian.org/security/2010/dsa-2100

http://www.mail-archive.com/openssl-dev%40openssl.org/msg28043.html

http://www.mail-archive.com/openssl-dev%40openssl.org/msg28045.html

http://www.mail-archive.com/openssl-dev%40openssl.org/msg28049.html

http://www.openwall.com/lists/oss-security/2010/08/11/6

http://www.vupen.com/english/advisories/2010/2038

Vendor Advisory

http://www.vupen.com/english/advisories/2010/2229

http://www.vupen.com/english/advisories/2010/3077

https://nvd.nist.gov/vuln/detail/CVE-2010-2939

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2010-2939

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2010-2939

EUVD