CVE-2010-2939
- State
- Published
- Severity
- Not scored
- Published
- Aug 17, 2010
- Updated
- Aug 7, 2024
- Reserved
- Aug 4, 2010
Description
Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted private key with an invalid prime. NOTE: some sources refer to this as a use-after-free issue.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- SSA:2010-326-01vendor-advisory
- [openssl-dev] 20100808 Re: openssl-1.0.0a and glibc detected sthg ;)mailing-list
- HPSBMA02662vendor-advisory
- 42413third-party-advisory
- 40906third-party-advisory
- DSA-2100vendor-advisory
- [oss-security] 20100812 Re: CVE Request: openssl double freemailing-list
- 20100807 openssl-1.0.0amailing-list
- ADV-2010-2229vdb-entry
- ADV-2010-2038vdb-entry
- 1024296vdb-entry
- USN-1003-1vendor-advisory
- 42309third-party-advisory
- ADV-2010-3077vdb-entry
- FreeBSD-SA-10:10vendor-advisory
- 43312third-party-advisory
- SUSE-SR:2010:021vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- [openssl-dev] 20100807 openssl-1.0.0a and glibc detected sthg ;)mailing-list
- [openssl-dev] 20100807 Re: openssl-1.0.0a and glibc detected sthg ;)mailing-list
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESXmailing-list
- 41105third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.