PT-2010-1088 · Openssl+1 · Openssl+1

Ronald Moesbergen · Published 2010-06-03 · Updated 2024-06-15 · CVE-2010-0742

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.0e OpenSSL versions prior to 0.9.8o OpenSSL versions prior to 1.0.0a

Description The issue affects the OpenSSL package in Gentoo Linux, allowing for remote exploitation that may compromise the confidentiality, integrity, and availability of protected information. Specifically, the Cryptographic Message Syntax (CMS) implementation does not properly handle structures containing OriginatorInfo, enabling context-dependent attackers to modify invalid memory locations, conduct double-free attacks, or possibly execute arbitrary code.

Recommendations For versions prior to 1.0.0e, update to version 1.0.0e or later. For versions prior to 0.9.8o, update to version 0.9.8o or later. For versions prior to 1.0.0a, update to version 1.0.0a or later.

Fix

Weakness Enumeration

CWE-399

CWE-310

Related Identifiers

BDU:2015-09418

CVE-2010-0742

HPSBUX02610

OPENSUSE-SU-2024:10271-1

OPENSUSE-SU-2024:10529-1

OPENSUSE-SU-2024:11127-1

SUSE-FU-2022:0445-1

Affected Products

Hp-Ux

Openssl

References · 168

• http://vupen.com/english/advisories/2010/1313 · Vendor Advisory
• http://secunia.com/advisories/40024 · Vendor Advisory
• http://secunia.com/advisories/40000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0742 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-0742 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11127-1 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=129138643405740&w=2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09418 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0742 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-0742 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-0742 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-2177 · Note
• http://openssl.org/news/secadv_20100601.txt · Note
• https://suse.com/security/cve/CVE-2015-0204 · Note
• https://suse.com/security/cve/CVE-2014-3513 · Note