new OpenSSL use-after-free race condition
 

http://ftp.openbsd.org/pub/OpenBSD/p..._openssl.patch

A use-after-free race condition in OpenSSL's read buffer may permit an attacker to inject data from one connection into another.

I've placed a fix at the vault: openssl-1.0.1g_CVE-2010-5298.diff.

--mancha

@Mancha:

That was a quick fix. Also thanks for the nice bug review in your security thread.

It seemed quicker than it really was. I had already put that fix together and was actually wrapping up my regression testing
when I saw your post. So, I slapped the CVE identifier on it and uploaded to the vault.

Thanks! And thanks to you for bringing it up in this thread and making Slackers aware of the issue.

--mancha