CVE-2010-0742: OpenSSL

High severity, CVSS 7.5. EPSS: 7.8% chance of exploitation in the next 30 days.

The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors.

Affected products

• OpenSSL OpenSSL: up to and including 0.9.8n; version 0.9.1c only; version 0.9.2b only; version 0.9.3 only; version 0.9.3a only; version 0.9.4 only; …

Published 2010-06-03. Last modified 2026-06-16.