NVD

Id
14370  
Name
CVE-2010-2939  
Description
Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted private key with an invalid prime. NOTE: some sources refer to this as a use-after-free issue.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-18  
Published
2010-08-17  
Modified Date
2011-05-03  
Seq
2010-2939  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
79457 14370 CVE-2010-2939 SUSE-SR:2010:021  View
79458 14370 CVE-2010-2939 HPSBMA02662  View
79459 14370 CVE-2010-2939 20100807 openssl-1.0.0a  View
79460 14370 CVE-2010-2939 FreeBSD-SA-10:10  View
79461 14370 CVE-2010-2939 1024296  View
79462 14370 CVE-2010-2939 SSA:2010-326-01  View
79463 14370 CVE-2010-2939 DSA-2100  View
79464 14370 CVE-2010-2939 [openssl-dev] 20100807 openssl-1.0.0a and glibc detected sthg ;)  View
79465 14370 CVE-2010-2939 [openssl-dev] 20100807 Re: openssl-1.0.0a and glibc detected sthg ;)  View
79466 14370 CVE-2010-2939 [openssl-dev] 20100808 Re: openssl-1.0.0a and glibc detected sthg ;)  View
79467 14370 CVE-2010-2939 [oss-security] 20100812 Re: CVE Request: openssl double free  View
79468 14370 CVE-2010-2939 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX  View
79469 14370 CVE-2010-2939 USN-1003-1  View
79470 14370 CVE-2010-2939 http://www.vmware.com/security/advisories/VMSA-2011-0003.html  View
79471 14370 CVE-2010-2939 ADV-2010-2038  View
79472 14370 CVE-2010-2939 ADV-2010-2229  View
79473 14370 CVE-2010-2939 ADV-2010-3077  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36707 JVNDB-2010-002487 OpenSSL クライアントの ssl3_get_key_exchange 関数における任意のコードを実行される脆弱性 OpenSSL の OpenSSL クライアント (ssl/s3_clnt.c) 内にある ssl3_get_key_exchange 関数は、 ECDH を使用している際、秘密鍵に関する処理に不備があるため、サービス運用妨害 (DoS) 状態となる、または任意のコードを実行される脆弱性が存在します。 CVE-2010-2939 45519 CVE-2010-2939 14370 4.3 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002487.html 2010-08-17 2011-02-28 View