Double Free Vulnerability in OpenBSD and LibreSSL Products
CVE-2023-35784
9.8CRITICAL
Summary
A vulnerability has been identified in OpenBSD versions 7.2 prior to errata 026 and 7.3 prior to errata 004, as well as in LibreSSL versions before 3.6.3 and 3.7.x before 3.7.3. The issue arises when SSL_clear is called, potentially leading to a double free or use after free situation. This flaw could be exploited to compromise application integrity and result in unexpected behavior, making it crucial for affected users to apply available patches immediately.
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved