BlackTreeCVE Intelligence
← Back to the CVE catalogue
Full vulnerability report · 2015
CVE-2015-1791High confidence

n/a: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

n/a · n/a

6.8MediumCVSS 2.0
Recommended action
Scheduled

Medium technical severity with no CISA KEV confirmation; remediate through the normal risk-based patch cycle unless local exposure raises the priority.

Fix not verified
Optional official sources

National CERT insights
?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

Select the national-authority views to include. The exact source language is shown on each matched advisory. Your choice is remembered on this device and encoded in the shareable URL.

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current
ENISA EUVD identifier

EUVD-2015-1917

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state
Present in the current official mapping
Known exploitation
Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score
Not supplied in the stored EUVD record
Advisory evidence
No linked advisory details stored yet
Recommended actionScheduled

Medium technical severity with no CISA KEV confirmation; remediate through the normal risk-based patch cycle unless local exposure raises the priority.

Fix not verified
01

What, why and how

Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.

What

Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.

Why

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

How

An attacker operating through the affected interface may attempt exploitation when the stated preconditions are met. If successful, the issue may disrupt the affected service.

What

Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.

Why

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

How

An attacker operating through the affected interface may attempt exploitation when the stated preconditions are met. If successful, the issue may disrupt the affected service.

02

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path
the affected interface → Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') → disrupt the affected service
Attack surface
Unspecified
Privileges required
None: unauthenticated exploitation is possible
User interaction
Not stated in the selected CVSS metric
Attack complexity
Not stated in the selected CVSS metric
Security boundary
Not stated in the selected CVSS metric
Weakness
?CWE means Common Weakness Enumeration: a standard category for the underlying weakness.
CWE-362 ↗

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

CVSS vector
?CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.
AV:N/AC:M/Au:N/C:P/I:P/A:P
Post-exploitation / living off the land
No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.
UnauthenticatedDenial of serviceCWE-362
A

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

BSI · German · WID-SEC-2026-0180Dell Data Protection Advisor: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.

Official advisory ↗
Canadian Centre for Cyber Security · English · AV17-105Oracle Critical Patch update Advisory – July 2017

eTools, versions 8.54, 8.55 PeopleSoft Enterprise PRTL Interaction Hub, version 9.1.0 Primavera Gateway, versions 1.0, 1.1, 14.2, 15.1, 15.2, 16.1, 16.2 Primavera P6 Enterprise Project Portfolio Management, versions 8.3, 8.4, 15.1, 15.2, 16.1, 16.2 Primavera Unifier, versions 9.13, 9.14, 10.1, 10.2, 15.1, 15.2, 16.1, 16.2 Siebel Applications, versions 16.0, 17.0 Solaris Cluster, version 4 Solaris, versions 10, 11 Sun ZFS Storage Appliance Kit (AK), version AK 2013 CVE References: CVE-2013-2027, CVE-2014-0224, CVE-2014-1912, CVE-2014-3566, CVE-2014-3571, CVE-2015-0235, CVE-2015-0254, CVE-2015-0286, CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792, CVE-2015-3195, CVE-2015-3197, CVE-2015-3253, CVE-2015-5254, CVE-2015-7501, CVE-2015-7940, CVE-2015-8607, CVE-2015-8608, CVE-2016-0635, CVE-2016-1181, CVE-2016-1950, CVE-2016-1979, CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2108, CVE-2016-2109, CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-2381, CVE-2016-2834, CVE-2016-3092, CVE-2016-3506, CVE-2016-4430, CVE-2016-4431, CVE-2016-4433, CVE-2016-4436, CVE-2016-4438, CVE-2016-4465, CVE-2016-5019, CVE-2016-5385, CVE-2016-5386, CVE-2016-5387, CVE-2016-5388, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE

Official advisory ↗
Canadian Centre for Cyber Security · English · AV17-048Oracle Critical Patch update Advisory – April 2017

Siebel Applications, version(s) 6.1, 6.2, 7.0, 7.1 Solaris Cluster, version(s) 4.3 Solaris, version(s) 10, 11.3 StorageTek Tape Analytics SW Tool, version(s) prior to 2.2.1 Sun ZFS Storage Appliance Kit (AK), version(s) AK 2013 CVE References: CVE-2004-2761, CVE-2012-0920, CVE-2012-1007, CVE-2012-5881, CVE-2012-5882, CVE-2012-5883, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1995, CVE-2013-1998, CVE-2013-2002, CVE-2013-2003, CVE-2013-2005, CVE-2013-2566, CVE-2013-5209, CVE-2014-0114, CVE-2014-3571, CVE-2014-3596, CVE-2015-0204, CVE-2015-0286, CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792, CVE-2015-3195, CVE-2015-3236, CVE-2015-3237, CVE-2015-4852, CVE-2015-5252, CVE-2015-5351, CVE-2015-7501, CVE-2015-7940, CVE-2016-0635, CVE-2016-0706, CVE-2016-0714, CVE-2016-0729, CVE-2016-0762, CVE-2016-0763, CVE-2016-1181, CVE-2016-1182, CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2109, CVE-2016-2176, CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-2510, CVE-2016-3092, CVE-2016-3504, CVE-2016-3506, CVE-2016-3607, CVE-2016-3674, CVE-2016-3739, CVE-2016-4430, CVE-2016-4431, CVE-2016-4433, CVE-2016-4436, CVE-2016-4802, CVE-2016-5018, CVE-2016-5019, CVE

Official advisory ↗
Canadian Centre for Cyber Security · English · AV17-007Oracle Critical Patch update Advisory – January 2017

, 8.4, 15.1, 15.2, 16.1, 16.2 Oracle Java SE, version(s) 6u131, 7u121, 8u112 Oracle Java SE Embedded, version(s) 8u111 Oracle JRockit, version(s) R28.3.12 Oracle VM Server for Sparc, version(s) 3.2, 3.4 Solaris, version(s) 11.3 Oracle VM VirtualBox, version(s) prior to 5.0.32, prior to 5.1.14 MySQL Cluster, version(s) 7.2.26 and prior, 7.3.14 and prior, 7.4.12 and prior MySQL Enterprise Monitor, version(s) 3.1.3.7856 and prior, 3.1.4.7895 and prior, 3.1.5.7958 and prior, 3.2.1.1049 and prior, 3.2.4.1102 and prior, 3.3.0.1098 and prior MySQL Server, version(s) 5.5.53 and prior, 5.6.34 and prior, 5.7.16 and prior CVE References: CVE-2015-0250, CVE-2015-1791, CVE-2015-3237, CVE-2015-3253, CVE-2015-5505, CVE-2015-7501, CVE-2015-7940, CVE-2016-6304, CVE-2016-0635, CVE-2016-0714, CVE-2016-0734, CVE-2016-1182, CVE-2016-1903, CVE-2016-2183, CVE-2016-5000, CVE-2016-5019, CVE-2016-5509, CVE-2016-5528, CVE-2016-5541, CVE-2016-5545, CVE-2016-5546, CVE-2016-5547, CVE-2016-5548, CVE-2016-5549, CVE-2016-5552, CVE-2016-5590, CVE-2016-5614, CVE-2016-5623, CVE-2016-6303, CVE-2016-6304, CVE-2016-7052, CVE-2016-8282, CVE-2016-8297, CVE-2016-8298, CVE-2016-8299, CVE-2016-8300, CVE-2016-8301, CVE-2016-8302, CVE-2016-8303, CVE-2016-8304, CVE-2016-8305, CVE-2016-8306, CVE-2016-8307, CVE-2016-8308, CVE-2016-8309, CVE

Official advisory ↗
CERT-FR · French · CERTFR-2022-AVI-1094Multiples vulnérabilités dans les produits Siemens

.cve.org/CVERecord?id=CVE-2015-0289 Référence CVE CVE-2015-0290 https://www.cve.org/CVERecord?id=CVE-2015-0290 Référence CVE CVE-2015-0291 https://www.cve.org/CVERecord?id=CVE-2015-0291 Référence CVE CVE-2015-0292 https://www.cve.org/CVERecord?id=CVE-2015-0292 Référence CVE CVE-2015-0293 https://www.cve.org/CVERecord?id=CVE-2015-0293 Référence CVE CVE-2015-1787 https://www.cve.org/CVERecord?id=CVE-2015-1787 Référence CVE CVE-2015-1788 https://www.cve.org/CVERecord?id=CVE-2015-1788 Référence CVE CVE-2015-1789 https://www.cve.org/CVERecord?id=CVE-2015-1789 Référence CVE CVE-2015-1790 https://www.cve.org/CVERecord?id=CVE-2015-1790 Référence CVE CVE-2015-1791 https://www.cve.org/CVERecord?id=CVE-2015-1791 Référence CVE CVE-2015-1792 https://www.cve.org/CVERecord?id=CVE-2015-1792 Référence CVE CVE-2015-1794 https://www.cve.org/CVERecord?id=CVE-2015-1794 Référence CVE CVE-2015-3193 https://www.cve.org/CVERecord?id=CVE-2015-3193 Référence CVE CVE-2015-3194 https://www.cve.org/CVERecord?id=CVE-2015-3194 Référence CVE CVE-2015-3195 https://www.cve.org/CVERecord?id=CVE-2015-3195 Référence CVE CVE-2015-3196 https://www.cve.org/CVERecord?id=CVE-2015-3196 Référence CVE CVE-2015-3197 https://www.cve.org/CVERecord?id=CVE-2015-3197 Référence CVE CVE-2015-4000 https://www.cve.org/CVERecord?id=CVE-2015-4000 Ré

Official advisory ↗
CERT-FR · French · CERTFR-2016-AVI-303Multiples vulnérabilités dans les produits Citrix

.cve.org/CVERecord?id=CVE-2015-0205 Référence CVE CVE-2015-0209 https://www.cve.org/CVERecord?id=CVE-2015-0209 Référence CVE CVE-2015-0286 https://www.cve.org/CVERecord?id=CVE-2015-0286 Référence CVE CVE-2015-0287 https://www.cve.org/CVERecord?id=CVE-2015-0287 Référence CVE CVE-2015-0288 https://www.cve.org/CVERecord?id=CVE-2015-0288 Référence CVE CVE-2015-0292 https://www.cve.org/CVERecord?id=CVE-2015-0292 Référence CVE CVE-2015-0293 https://www.cve.org/CVERecord?id=CVE-2015-0293 Référence CVE CVE-2015-1788 https://www.cve.org/CVERecord?id=CVE-2015-1788 Référence CVE CVE-2015-1789 https://www.cve.org/CVERecord?id=CVE-2015-1789 Référence CVE CVE-2015-1791 https://www.cve.org/CVERecord?id=CVE-2015-1791 Référence CVE CVE-2015-1792 https://www.cve.org/CVERecord?id=CVE-2015-1792 Référence CVE CVE-2015-4000 https://www.cve.org/CVERecord?id=CVE-2015-4000 Référence CVE CVE-2016-7092 https://www.cve.org/CVERecord?id=CVE-2016-7092 Référence CVE CVE-2016-7093 https://www.cve.org/CVERecord?id=CVE-2016-7093 Référence CVE CVE-2016-7094 https://www.cve.org/CVERecord?id=CVE-2016-7094 Référence CVE CVE-2016-7154 https://www.cve.org/CVERecord?id=CVE-2016-7154 Gestion détaillée du document le 09 septembre 2016 version initiale. Alertes Avis Bulletins d’actualités Mentions légales Conditions générales À propos

Official advisory ↗
CERT-FR · French · CERTFR-2016-AVI-128Multiples vulnérabilités dans les produits Juniper

.cve.org/CVERecord?id=CVE-2013-4449 Référence CVE CVE-2014-0015 https://www.cve.org/CVERecord?id=CVE-2014-0015 Référence CVE CVE-2014-3613 https://www.cve.org/CVERecord?id=CVE-2014-3613 Référence CVE CVE-2014-3620 https://www.cve.org/CVERecord?id=CVE-2014-3620 Référence CVE CVE-2014-3707 https://www.cve.org/CVERecord?id=CVE-2014-3707 Référence CVE CVE-2014-8150 https://www.cve.org/CVERecord?id=CVE-2014-8150 Référence CVE CVE-2014-8151 https://www.cve.org/CVERecord?id=CVE-2014-8151 Référence CVE CVE-2015-1789 https://www.cve.org/CVERecord?id=CVE-2015-1789 Référence CVE CVE-2015-1790 https://www.cve.org/CVERecord?id=CVE-2015-1790 Référence CVE CVE-2015-1791 https://www.cve.org/CVERecord?id=CVE-2015-1791 Référence CVE CVE-2015-2601 https://www.cve.org/CVERecord?id=CVE-2015-2601 Référence CVE CVE-2015-2613 https://www.cve.org/CVERecord?id=CVE-2015-2613 Référence CVE CVE-2015-2625 https://www.cve.org/CVERecord?id=CVE-2015-2625 Référence CVE CVE-2015-2659 https://www.cve.org/CVERecord?id=CVE-2015-2659 Référence CVE CVE-2015-2808 https://www.cve.org/CVERecord?id=CVE-2015-2808 Référence CVE CVE-2015-3143 https://www.cve.org/CVERecord?id=CVE-2015-3143 Référence CVE CVE-2015-3144 https://www.cve.org/CVERecord?id=CVE-2015-3144 Référence CVE CVE-2015-3145 https://www.cve.org/CVERecord?id=CVE-2015-3145 Ré

Official advisory ↗
CERT-FR · French · CERTFR-2015-AVI-444Multiples vulnérabilités dans Oracle Peoplesoft

De multiples vulnérabilités ont été corrigées dans Oracle Peoplesoft . Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Official advisory ↗
CERT-FR · French · CERTFR-2015-AVI-431Multiples vulnérabilités dans les produits Juniper

.cve.org/CVERecord?id=CVE-2014-6450 Référence CVE CVE-2014-6451 https://www.cve.org/CVERecord?id=CVE-2014-6451 Référence CVE CVE-2014-8159 https://www.cve.org/CVERecord?id=CVE-2014-8159 Référence CVE CVE-2014-8867 https://www.cve.org/CVERecord?id=CVE-2014-8867 Référence CVE CVE-2015-1158 https://www.cve.org/CVERecord?id=CVE-2015-1158 Référence CVE CVE-2015-1159 https://www.cve.org/CVERecord?id=CVE-2015-1159 Référence CVE CVE-2015-1788 https://www.cve.org/CVERecord?id=CVE-2015-1788 Référence CVE CVE-2015-1789 https://www.cve.org/CVERecord?id=CVE-2015-1789 Référence CVE CVE-2015-1790 https://www.cve.org/CVERecord?id=CVE-2015-1790 Référence CVE CVE-2015-1791 https://www.cve.org/CVERecord?id=CVE-2015-1791 Référence CVE CVE-2015-1792 https://www.cve.org/CVERecord?id=CVE-2015-1792 Référence CVE CVE-2015-1793 https://www.cve.org/CVERecord?id=CVE-2015-1793 Référence CVE CVE-2015-2808 https://www.cve.org/CVERecord?id=CVE-2015-2808 Référence CVE CVE-2015-5361 https://www.cve.org/CVERecord?id=CVE-2015-5361 Référence CVE CVE-2015-5600 https://www.cve.org/CVERecord?id=CVE-2015-5600 Référence CVE CVE-2015-7748 https://www.cve.org/CVERecord?id=CVE-2015-7748 Référence CVE CVE-2015-7749 https://www.cve.org/CVERecord?id=CVE-2015-7749 Référence CVE CVE-2015-7750 https://www.cve.org/CVERecord?id=CVE-2015-7750 Ré

Official advisory ↗
CERT-FR · French · CERTFR-2015-AVI-355Multiples vulnérabilités dans Apple OS X

.cve.org/CVERecord?id=CVE-2015-0228 Référence CVE CVE-2015-0241 https://www.cve.org/CVERecord?id=CVE-2015-0241 Référence CVE CVE-2015-0242 https://www.cve.org/CVERecord?id=CVE-2015-0242 Référence CVE CVE-2015-0243 https://www.cve.org/CVERecord?id=CVE-2015-0243 Référence CVE CVE-2015-0244 https://www.cve.org/CVERecord?id=CVE-2015-0244 Référence CVE CVE-2015-0253 https://www.cve.org/CVERecord?id=CVE-2015-0253 Référence CVE CVE-2015-1788 https://www.cve.org/CVERecord?id=CVE-2015-1788 Référence CVE CVE-2015-1789 https://www.cve.org/CVERecord?id=CVE-2015-1789 Référence CVE CVE-2015-1790 https://www.cve.org/CVERecord?id=CVE-2015-1790 Référence CVE CVE-2015-1791 https://www.cve.org/CVERecord?id=CVE-2015-1791 Référence CVE CVE-2015-1792 https://www.cve.org/CVERecord?id=CVE-2015-1792 Référence CVE CVE-2015-2783 https://www.cve.org/CVERecord?id=CVE-2015-2783 Référence CVE CVE-2015-2787 https://www.cve.org/CVERecord?id=CVE-2015-2787 Référence CVE CVE-2015-3143 https://www.cve.org/CVERecord?id=CVE-2015-3143 Référence CVE CVE-2015-3144 https://www.cve.org/CVERecord?id=CVE-2015-3144 Référence CVE CVE-2015-3145 https://www.cve.org/CVERecord?id=CVE-2015-3145 Référence CVE CVE-2015-3148 https://www.cve.org/CVERecord?id=CVE-2015-3148 Référence CVE CVE-2015-3153 https://www.cve.org/CVERecord?id=CVE-2015-3153 Ré

Official advisory ↗
CERT-FR · French · CERTFR-2015-AVI-308Multiples vulnérabilités dans Oracle Solaris

.cve.org/CVERecord?id=CVE-2015-0231 Référence CVE CVE-2015-0232 https://www.cve.org/CVERecord?id=CVE-2015-0232 Référence CVE CVE-2015-0255 https://www.cve.org/CVERecord?id=CVE-2015-0255 Référence CVE CVE-2015-0261 https://www.cve.org/CVERecord?id=CVE-2015-0261 Référence CVE CVE-2015-0273 https://www.cve.org/CVERecord?id=CVE-2015-0273 Référence CVE CVE-2015-1351 https://www.cve.org/CVERecord?id=CVE-2015-1351 Référence CVE CVE-2015-1788 https://www.cve.org/CVERecord?id=CVE-2015-1788 Référence CVE CVE-2015-1789 https://www.cve.org/CVERecord?id=CVE-2015-1789 Référence CVE CVE-2015-1790 https://www.cve.org/CVERecord?id=CVE-2015-1790 Référence CVE CVE-2015-1791 https://www.cve.org/CVERecord?id=CVE-2015-1791 Référence CVE CVE-2015-1792 https://www.cve.org/CVERecord?id=CVE-2015-1792 Référence CVE CVE-2015-1855 https://www.cve.org/CVERecord?id=CVE-2015-1855 Référence CVE CVE-2015-2331 https://www.cve.org/CVERecord?id=CVE-2015-2331 Référence CVE CVE-2015-2348 https://www.cve.org/CVERecord?id=CVE-2015-2348 Référence CVE CVE-2015-2787 https://www.cve.org/CVERecord?id=CVE-2015-2787 Référence CVE CVE-2015-3294 https://www.cve.org/CVERecord?id=CVE-2015-3294 Référence CVE CVE-2015-3988 https://www.cve.org/CVERecord?id=CVE-2015-3988 Référence CVE CVE-2015-4000 https://www.cve.org/CVERecord?id=CVE-2015-4000 Ge

Official advisory ↗
CERT-FR · French · CERTFR-2015-AVI-257Multiples vulnérabilités dans OpenSSL

De multiples vulnérabilités ont été corrigées dans OpenSSL . Elles permettent à un attaquant de provoquer un déni de service à distance et une atteinte à la confidentialité des données.

Official advisory ↗
JVN iPedia · Japanese · JVNDB-2015-003083OpenSSL の ssl/s3_clnt.c の ssl3_get_new_session_ticket 関数におけるサービス運用妨害 (DoS) の脆弱性

OpenSSL の ssl/s3_clnt.c の ssl3_get_new_session_ticket 関数には、マルチスレッドクライアントのために使用された場合、競合状態により、サービス運用妨害 (二重解放およびアプリケーションクラッシュ) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。

Official advisory ↗
KISA KrCERT/CC · Korean · KNVD-4522OpenSSL 다중 취약점 보안업데이트 권고

NewSessionTicket 처리 중 발생하는 Race condition 취약점 (CVE-2015-1791)

Official advisory ↗
03

Patch and workaround

Operational remediation based on structured source evidence.

Status
?Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.
Fix not verified
Affected
n/a: n/a
Fixed
No fixed version is explicitly recorded in the structured CVE data.
Action
No verified patch reference is present in the current structured sources. Check the vendor advisory before making a change.
Workaround
No verified workaround is recorded. Limit untrusted access and use least privilege until authoritative guidance is available.
04

Evidence and provenance

Published 12 Jun 2015 · Last source change 6 Aug 2024, 04:54 UTC · CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE recordCVE.org · 5.1
CVSS sourceNIST NVD
EPSS source
?The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.
FIRST · tracked since 2026-09-01
European sourceENISA EUVD · EUVD-2015-1917
Product sourceCNA
Remediation sourceCVE/CNA references
CWE sourceNIST NVD
NVD statusNVD modified after enrichment

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates ↗
  1. Vendor guidanceAuthoritative vendor guidance changed from vendor advisory to vendor advisory.
    Before
    vendor advisory
    After
    vendor advisory
    af854a3a-2127-422b-91ae-364da2661108 ↗
  2. SeveritySeverity changed from Unknown to Medium.
    Before
    Unknown
    After
    Medium
    NIST NVD ↗
  3. CVSS scoreCVSS score changed from not recorded to 6.8 (CVSS 2.0 · NIST NVD · AV:N/AC:M/Au:N/C:P/I:P/A:P).
    Before
    not recorded
    After
    6.8 (CVSS 2.0 · NIST NVD · AV:N/AC:M/Au:N/C:P/I:P/A:P)
    NIST NVD ↗
  4. ENISA EUVD mappingEUVD-2015-1917 was added to the official ENISA EUVD mapping for this CVE.
    Before
    not recorded
    After
    {"euvdId":"EUVD-2015-1917"}
    ENISA EUVD ↗
  5. Catalogue recordCVE added to the BlackTree catalogue.
    CNA ↗
Material fields only · duplicate refreshes suppressed · history retained for the configured operational retention period
CVE published
ENISA EUVD · EUVD-2015-1917↗Vendor advisory↗CVE authority or vendor reference↗Official CVE record (CNA and ADP data)↗NVD record↗
Technical terms and abbreviations used in this report
CVE
Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS
Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS
Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE
Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA
CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP
Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD
National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT
A computer security incident response team that publishes warnings or coordinates incident response.
PoC
Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF
Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL
Living off the land: abuse of legitimate tools or system functions during an attack.
Free version - for non-commercial use only.CVE-2015-1791 · cve.blacktree.nl