Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2011-4109

38
FAUCET Score

CVE-2011-4109 describes a double free vulnerability in OpenSSL versions prior to 0.9.8s, specifically when X509_V_FLAG_POLICY_CHECK is enabled. This flaw allows remote attackers to achieve a severe impact, including potential compromise of confidentiality, integrity, and availability, due to its high CVSS score of 9.3. While the vulnerability is critical, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion, suggesting it is not currently a widespread threat.

Impacted Technologies

VendorProductVersion(s)CPE
0.9.8CPE matchmatch criteria
cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:*
0.9.8aCPE matchmatch criteria
cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:*
0.9.8bCPE matchmatch criteria
cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:*
0.9.8cCPE matchmatch criteria
cpe:2.3:a:openssl:openssl:0.9.8c:*:*:*:*:*:*:*
0.9.8dCPE matchmatch criteria
cpe:2.3:a:openssl:openssl:0.9.8d:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

9.3HIGH

AV:N/AC:M/Au:N/C:C/I:C/A:C

Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Exploitability Score
8.6
Impact Score
10.0
CvssVersion
2.0

Exploit Intelligence

EPSS Score
17.69%
Probability of exploitation in next 30 days
EPSS Percentile
96.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.1769 is in the 83rd percentile among its peer group of 8,920 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: openssl-0:0.9.8e-20.el5_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 5.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 6.0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 1.0
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: openssl098e

Vendor Advisories (1)

redhatCVE-2011-4109Moderate

openssl: double-free in policy checks

Jan 4, 2012

References

aix.software.ibm.com / aix/efixes/security/openssl_advisory3.asc
lists.apple.com / archives/security-announce/2013/Jun/msg00000.html
lists.opensuse.org / opensuse-security-announce/2012-01/msg00018.html
marc.info
marc.info
rhn.redhat.com / errata/RHSA-2012-1306.html
rhn.redhat.com / errata/RHSA-2012-1307.html
rhn.redhat.com / errata/RHSA-2012-1308.html
secunia.com / advisories/48528
exchange.xforce.ibmcloud.com / vulnerabilities/72129
support.apple.com / kb/HT5784
debian.org / security/2012/dsa-2390
kb.cert.org / vuls/id/737740
US Government Resource
mandriva.com / security/advisories
mandriva.com / security/advisories
openssl.org / news/secadv_20120104.txt
Vendor Advisory