Every CVE Search/ Get API key

CVE-2010-5298

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when...

4.0 MediumFix available

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Exploit likelihood

34.1%Up 18.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.0

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Record
CVE-2010-5298
CVSS 2.0
4.0 MediumAV:N/AC:H/Au:N/C:N/I:P/A:P
Weakness
CWE-362
Updated
2026-11-02
CVE List No score

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Record
CVE-2010-5298
Updated
2026-11-02
EUVDEUVD-2010-5257 No score

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Record
EUVD-2010-5257
Updated
2026-11-03
GitHub AdvisoriesGHSA-m249-hh62-97m2 No score

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when...

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Record
GHSA-m249-hh62-97m2
Weakness
CWE-362
Updated
2026-11-02
OSV No score

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Record
CVE-2010-5298
Updated
2026-11-02
OSVDEBIAN-CVE-2010-5298 No score

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Record
DEBIAN-CVE-2010-5298
Updated
2026-11-02
Show 11 moreShow less
OSVMGASA-2014-0187 No score

Updated openssl packages fix CVE-2010-5298

Updated openssl packages fix security vulnerability:

A read buffer can be freed even when it still contains data that is used later on, leading to a use-after-free. Given a race condition in a multi-threaded application it may permit an attacker to inject data from one connection into another or cause denial of service (CVE-2010-5298).

Also fixed in this update is a potential security issue with detection of the "critical" flag for the TSA extended key usage under certain cases.

Record
MGASA-2014-0187
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-RU-2015:0769-1
Updated
2026-11-02
OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0546-1
Updated
2026-11-02
OSVSUSE-SU-2015:0743-1 No score

Security update for mariadb

mariadb was updated to version 10.0.16 to fix 40 security issues.

These security issues were fixed:

  • CVE-2015-0411: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption (bnc#915911).
  • CVE-2015-0382: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allowed remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381 (bnc#915911).
  • CVE-2015-0381: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allowed remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382 (bnc#915911).
  • CVE-2015-0432: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allowed remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key (bnc#915911).
  • CVE-2014-6568: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allowed remote authenticated users to affect availability via vectors related to Server : InnoDB : DML (bnc#915911).
  • CVE-2015-0374: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allowed remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key (bnc#915911).
  • CVE-2014-6507: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (bnc#915912).
  • CVE-2014-6491: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6500 (bnc#915912).
  • CVE-2014-6500: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491 (bnc#915912).
  • CVE-2014-6469: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and eariler and 5.6.20 and earlier allowed remote authenticated users to affect availability via vectors related to SERVER:OPTIMIZER (bnc#915912).
  • CVE-2014-6555: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allowed remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (bnc#915912).
  • CVE-2014-6559: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING (bnc#915912).
  • CVE-2014-6494: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6496 (bnc#915912).
  • CVE-2014-6496: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allowed remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494 (bnc#915912).
  • CVE-2014-6464: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allowed remote authenticated users to affect availability via vectors related to SERVER:INNODB DML FOREIGN KEYS (bnc#915912).
  • CVE-2010-5298: Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when…
Record
SUSE-SU-2015:0743-1
Updated
2026-11-02
OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1185-1
Updated
2026-11-02
OSVUBUNTU-CVE-2010-5298 No score

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Record
UBUNTU-CVE-2010-5298
Updated
2026-11-02
OSVUSN-2192-1 No score

openssl vulnerabilities

It was discovered that OpenSSL incorrectly handled memory in the ssl3_read_bytes() function. A remote attacker could use this issue to possibly cause OpenSSL to crash, resulting in a denial of service. (CVE-2010-5298)

It was discovered that OpenSSL incorrectly handled memory in the do_ssl3_write() function. A remote attacker could use this issue to possibly cause OpenSSL to crash, resulting in a denial of service. (CVE-2014-0198)

Record
USN-2192-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 1.0.1g-3
1.0.1g-3
openssl
Debian:13
 before 1.0.1g-3
1.0.1g-3
openssl
Debian:14
 before 1.0.1g-3
1.0.1g-3
openssl
Debian:7
 before 1.0.1e-2+deb7u7, plus listed versions
1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u6
1.0.1e-2+deb7u7
openssl
Mageia:3
 before 1.0.1e-1.7.mga3
1.0.1e-1.7.mga3
openssl
Mageia:4
 before 1.0.1e-8.4.mga4
1.0.1e-8.4.mga4
openssl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
Show 52 moreShow less
Affected packages
PackageAffectedFixed
openssl-static
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-debuginfo
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-devel
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-perl
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl-static
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.14
0:1.0.1e-16.el6_5.14
openssl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::client
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::computenode
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::server
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-devel
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-libs
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-perl
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
openssl-static
Red Hat:enterprise_linux:7::workstation
 before 1:1.0.1e-34.el7_0.3
1:1.0.1e-34.el7_0.3
mariadb
SUSE:Linux Enterprise Desktop 12
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Software Development Kit 12
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Server 12
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Server for SAP Applications 12
 before 10.0.16-15.1
10.0.16-15.1
mariadb
SUSE:Linux Enterprise Workstation Extension 12
 before 10.0.16-15.1
10.0.16-15.1
openssl
Ubuntu:14.04:LTS
 before 1.0.1f-1ubuntu2.1, plus listed versions
1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu41.0.1f-1ubuntu11.0.1f-1ubuntu2
1.0.1f-1ubuntu2.1
openssl-1_1
openSUSE:Tumbleweed
 before 1.1.1l-1.2
1.1.1l-1.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-5298 is a medium vulnerability (CVSS 4.0) in Openssl, published April 14, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 34.1%, the 98th percentile. Fixed in openssl 1.0.1g-3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 667 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open