Description
Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 0.9.8o-3 | — |
| Debian 13 | openssl | 0.9.8o-3 | — |
| Debian 12 | openssl | 0.9.8o-3 | — |
| Debian 5.0 | openssl | 0.9.8g-15+lenny9 | DSA-2125-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | openssl +3 | 1.0.0-4.el6_0.1 | RHSA-2010:0888 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
| openSUSE Tumbleweed | stunnel | 5.38-1.1 | openSUSE-SU-2024:10289-1 |
Advisories 6
- RHSA-2010:0888 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2125-1 openssl - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-403 Forbidden-1 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-403 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10289-1 stunnel-5.38-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- FEDORA-2010-17827 vendor-advisory
- HPSBGN02740 vendor-advisory
- SSA:2010-326-01 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
- ADV-2010-3041 vdb-entry
- http://support.apple.com/kb/HT4723
- 1024743 vdb-entry
- http://blogs.sun.com/security/entry/cve_2010_3864_race_condition
- 42413 third-party-advisory
- FEDORA-2010-17826 vendor-advisory
- http://openssl.org/news/secadv_20101116.txt
- APPLE-SA-2011-06-23-1 vendor-advisory
- SUSE-SR:2010:022 vendor-advisory
- [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.0.6a has been released mailing-list
- FEDORA-2010-17847 vendor-advisory
- VU#737740 third-party-advisory
- RHSA-2010:0888 vendor-advisory
- 42397 third-party-advisory
- SSRT100475 vendor-advisory
- 42241 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=649304
- HPSBMA02658 vendor-advisory
- HPSBUX02638 vendor-advisory
- 57353 third-party-advisory
- [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.2.1a has been released mailing-list
- ADV-2010-3097 vdb-entry
- http://www.adobe.com/support/security/bulletins/apsb11-11.html
- 42336 third-party-advisory
- 42309 third-party-advisory
- ADV-2010-3077 vdb-entry
- FreeBSD-SA-10:10 vendor-advisory
- 44269 third-party-advisory
- 43312 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- 42243 third-party-advisory
- ADV-2010-3121 vdb-entry
- 42352 third-party-advisory
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- DSA-2125 vendor-advisory