Title: Two more vulnerabilities patched so expect to be seeing package updates soon.<p>The 4 year old CVE-2010-5298 is described  as<p>&quot;Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.&quot;<p>The more concerning part obviously being data injection.<p>CVE-2014-0198 is described as &quot;A null pointer dereference bug was discovered in so_ssl3_write().
An attacker could possibly use this to cause OpenSSL to crash,
resulting in a denial of service.&quot;<p>Clearly in the wake of heartbleed OpenSSL is undergoing serious scrutiny; and hopefully this results in a wider attitude change:<p>Just because something is opensource doesn&#x27;t mean someone has audited the code for you, it&#x27;s there you can read it yourself ... 20:20 hindsight eh?<p>Ah well sleep is truely for quitters ... <i>headdesk</i>
Upvote: