7.6

CVE-2010-3864

Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography.

Data is provided by the National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version0.9.8f
OpenSSL ≫ OpenSSL Version0.9.8g
OpenSSL ≫ OpenSSL Version0.9.8h
OpenSSL ≫ OpenSSL Version0.9.8i
OpenSSL ≫ OpenSSL Version0.9.8j
OpenSSL ≫ OpenSSL Version0.9.8k
OpenSSL ≫ OpenSSL Version0.9.8l
OpenSSL ≫ OpenSSL Version0.9.8m
OpenSSL ≫ OpenSSL Version0.9.8n
OpenSSL ≫ OpenSSL Version0.9.8o
OpenSSL ≫ OpenSSL Version1.0.0
OpenSSL ≫ OpenSSL Version1.0.0a
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 7.36% 0.913
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.6 4.9 10
AV:N/AC:H/Au:N/C:C/I:C/A:C
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.