Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.
CVSS Details
- CVSS 3.1 Base Score: 7.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openssl | Aug 30, 2017 | Apr 14, 2014 |
| Centos_linux | — | Upgrade opensslUpgrade openssl-develUpgrade openssl-staticUpgrade openssl-perl | Dec 1, 2016 | Apr 14, 2014 |
| Debian | — | Upgrade openssl | Jul 30, 2024 | Apr 14, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jun 20, 2014 |
| Freebsd | — | Upgrade FreeBSDUpgrade mingw32-opensslUpgrade openssl | Dec 10, 2025 | Apr 23, 2014 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Oct 30, 2017 | Apr 14, 2014 |
| Hpsim | — | Upgrade to the latest version of HP Systems Insight Manager | Oct 13, 2015 | Apr 14, 2014 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Apr 14, 2014 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2014 | Apr 14, 2014 |
| Huawei Vrp | — | Contact Huawei TAC to request the upgrades | May 29, 2026 | Jun 13, 2014 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory8 | Nov 30, 2017 | Apr 14, 2014 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Apr 14, 2014 |
| Oracle Solaris | — | Upgrade library/security/openssl to version 1.0.0.13-0.175.1.21.0.2.0 on Solaris 11.1Upgrade library/security/openssl/openssl-fips-140 to version 1.2-0.175.1.21.0.2.0 on Solaris 11.1 | May 29, 2017 | Apr 14, 2014 |
| Oracle_linux | — | Upgrade opensslUpgrade openssl-staticUpgrade openssl-libsUpgrade openssl-develUpgrade openssl-perl | May 13, 2016 | Apr 14, 2014 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 8.0R4.1Update Pulse Connect Secure to version 7.1R19.1Update Pulse Connect Secure to version 7.4R11.1 | Oct 28, 2020 | Apr 14, 2014 |
| Suse | — | Upgrade openssl1-docUpgrade libmysqlclient18-32bitUpgrade libopenssl-1_1-devel-32bitUpgrade mariadb-100-errormessagesUpgrade libopenssl1_1-32bitUpgrade libopenssl1_0_0-hmac-32bitUpgrade libopenssl1_1-hmacUpgrade openssl-1_0_0Upgrade libopenssl-develUpgrade mariadb-errormessagesUpgrade libmysqlclient_r18Upgrade openssl-docUpgrade openssl-1_1Upgrade libmysqld-develUpgrade libopenssl1_0_0-32bitUpgrade mariadb-toolsUpgrade libmysqlclient_r18-32bitUpgrade libopenssl1_0_0Upgrade opensslUpgrade libopenssl1_1Upgrade libmysqlclient-develUpgrade libopenssl1_0_0-hmacUpgrade libopenssl-1_1-develUpgrade libmysqld18Upgrade mariadb-clientUpgrade openssl-1_0_0-docUpgrade libopenssl-1_0_0-develUpgrade libopenssl-fips-providerUpgrade libopenssl1_0_0-x86Upgrade libopenssl1_1-hmac-32bitUpgrade libopenssl1-develUpgrade mariadbUpgrade openssl1Upgrade libmysqlclient18 | May 29, 2014 | Apr 15, 2014 |
| Ubuntu | — | Upgrade libssl1.0.0 | Nov 8, 2024 | Apr 14, 2014 |
| Vmsa 2014 0006 | — | Upgrade VMware ESXi 5.0 to build number 1918656Upgrade VMware ESXi 5.1 to build number 1900470Upgrade VMware ESXi 5.5 to build number 1881737 | Jun 19, 2014 | Apr 14, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub