Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Airport | — | Apply OS X security update 2011-004 | Aug 28, 2015 | Nov 17, 2010 |
| Apple Osx Openssl | — | Upgrade macOS to the latest version | Dec 16, 2011 | Nov 17, 2010 |
| Debian | — | Upgrade openssl | Jul 30, 2024 | Nov 17, 2010 |
| Freebsd | — | Upgrade openssl | Dec 10, 2025 | Nov 17, 2010 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Oct 30, 2017 | Nov 17, 2010 |
| Hpux | — | Update openssl.OPENSSL-CONF to the latest versionUpdate openssl.OPENSSL-RUN to the latest versionUpdate openssl.OPENSSL-CER to the latest versionUpdate openssl.OPENSSL-DOC to the latest versionUpdate openssl.OPENSSL-PRNG to the latest versionUpdate openssl.OPENSSL-MAN to the latest versionUpdate openssl.OPENSSL-PVT to the latest versionUpdate openssl.OPENSSL-SRC to the latest versionUpdate openssl.OPENSSL-INC to the latest versionUpdate openssl.OPENSSL-MIS to the latest versionUpdate openssl.OPENSSL-LIB to the latest version | Aug 11, 2017 | Nov 17, 2010 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jan 26, 2012 | Nov 17, 2010 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory2 | Nov 30, 2017 | Nov 17, 2010 |
| Oracle_linux | — | Upgrade openssl-staticUpgrade openssl-perlUpgrade opensslUpgrade openssl-devel | May 13, 2016 | Nov 17, 2010 |
| Suse | — | Upgrade libopenssl0_9_8-hmacUpgrade libopenssl1_1-hmac-32bitUpgrade libopenssl1_1-hmacUpgrade openssl1Upgrade libopenssl0_9_8-hmac-32bitUpgrade opensslUpgrade libopenssl1_0_0-hmac-32bitUpgrade libopenssl1-develUpgrade libopenssl-1_1-develUpgrade libopenssl0_9_8-32bitUpgrade libopenssl-1_1-devel-32bitUpgrade openssl-docUpgrade openssl-1_0_0-docUpgrade openssl-1_0_0Upgrade libopenssl-develUpgrade libopenssl1_0_0-hmacUpgrade libopenssl1_0_0Upgrade libopenssl-fips-providerUpgrade libopenssl-1_0_0-develUpgrade libopenssl1_1Upgrade stunnel-docUpgrade openssl1-docUpgrade libopenssl1_1-32bitUpgrade libopenssl1_0_0-32bitUpgrade libopenssl0_9_8Upgrade openssl-1_1Upgrade stunnelUpgrade libopenssl0_9_8-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libssl0.9.8 | Nov 8, 2024 | Nov 17, 2010 |
| Vmsa 2011 0003 | — | Upgrade VMware ESXi 4.1 to build number 348481Upgrade VMware ESX 4.0 to build number 360236Upgrade VMware ESXi 4.0 to build number 360236Upgrade VMware ESX 4.1 to build number 348481 | Feb 16, 2011 | Nov 17, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub