cbcvebase.
CVE-2009-5009
published 2010-10-14

CVE-2009-5009: Double free vulnerability in OpenConnect before 1.40 might allow remote AnyConnect SSL VPN servers to cause a denial of service (application crash) or possibly…

PriorityP415medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
0.98%
58.6th percentile
Double free vulnerability in OpenConnect before 1.40 might allow remote AnyConnect SSL VPN servers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted DTLS Cipher option during a reconnect operation.

Affected

9 ranges
VendorProductVersion rangeFixed in
debianopenconnect< openconnect 1.40-1 (bookworm)openconnect 1.40-1 (bookworm)
infradeadopenconnect<= 1.30—
infradeadopenconnect——
infradeadopenconnect——
infradeadopenconnect——
infradeadopenconnect>= 0 < 1.40-11.40-1
infradeadopenconnect>= 0 < 1.40-11.40-1
infradeadopenconnect>= 0 < 1.40-11.40-1
infradeadopenconnect>= 0 < 1.40-11.40-1

CVSS provenance

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.