Published: 03/03/2016 Updated: 07/11/2023

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 891

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 prior to 1.0.1s and 1.0.2 prior to 1.0.2g allows remote malicious users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle mysql
openssl openssl 1.0.1m
openssl openssl 1.0.2a
openssl openssl 1.0.1j
openssl openssl 1.0.1
openssl openssl 1.0.1h
openssl openssl 1.0.2e
openssl openssl 1.0.1r
openssl openssl 1.0.2b
openssl openssl 1.0.1c
openssl openssl 1.0.1g
openssl openssl 1.0.1a
openssl openssl 1.0.1d
openssl openssl 1.0.2c
openssl openssl 1.0.2
openssl openssl 1.0.1p
openssl openssl 1.0.1k
openssl openssl 1.0.1b
openssl openssl 1.0.1n
openssl openssl 1.0.1q
openssl openssl 1.0.1e
openssl openssl 1.0.1l
openssl openssl 1.0.1f
openssl openssl 1.0.1o
openssl openssl 1.0.2f
openssl openssl 1.0.1i
openssl openssl 1.0.2d
google android 5.1.0
google android 4.2
google android 4.1
google android 6.0.1
google android 6.0
google android 4.0.2
google android 4.4.3
google android 4.0.4
google android 4.3
google android 4.0.1
google android 4.2.1
google android 5.0.1
google android 5.0
google android 4.0.3
google android 4.0
google android 4.4
google android 4.4.1
google android 4.2.2
google android 4.3.1
google android 4.4.2
google android 5.1
google android 4.1.2
canonical ubuntu linux 12.04
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04
debian debian linux 8.0
debian debian linux 7.0

Debian Bug report logs - #821094 Security fixes from the April 2016 CPU Package: src:mysql-56; Maintainer for src:mysql-56 is (unknown); Reported by: "Norvald H Ryeng" <norvaldryeng@oraclecom> Date: Fri, 15 Apr 2016 12:03:01 UTC Severity: grave Tags: fixed-upstream, security, upstream Found in version mysql-56/562 ...

Several security issues were fixed in OpenSSL ...

Synopsis Important: java-180-ibm security update Type/Severity Security Advisory: Important Topic An update for java-180-ibm is now available for Red Hat Enterprise Linux 7 SupplementaryRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scori ...

Synopsis Moderate: java-180-ibm security update Type/Severity Security Advisory: Moderate Topic An update for java-180-ibm is now available for Red Hat Satellite 58Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base ...

Synopsis Important: java-180-ibm security update Type/Severity Security Advisory: Important Topic An update for java-180-ibm is now available for Red Hat Enterprise Linux 6 SupplementaryRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scori ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP 2423 Release Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services httpd 2423 is now available from the Red Hat Customer Portal for Solaris and Microsoft Windows systemsRed Hat Product Security has rated this release as ...

A double-free flaw was found in the way OpenSSL parsed certain malformed DSA (Digital Signature Algorithm) private keys An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash ...

A double-free flaw was found in the way OpenSSL parsed certain malformed DSA (Digital Signature Algorithm) private keys An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash (CVE-2016-0705) The ssl_verify_server_cert function in sql-common/ ...

A padding oracle flaw was found in the Secure Sockets Layer version 20 (SSLv2) protocol An attacker can potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections This cross-protocol attack is publicly referred to as DROWN (CVE-2016-0800) Pri ...

Nessus is potentially impacted by several vulnerabilities in OpenSSL that were recently disclosed and fixed Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to upgrade the included version of OpenSSL as a precaution, and to save time The issues include: CVE-2016-0800 Secure Sockets Layer Version 2 (SSL ...

Orion Elite Hidden IP Browser Pro versions 10 through 79 have insecure versions of Tor and OpenSSL included and also suffer from man-in-the-middle vulnerabilities ...

CVE-2016-0705

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Exploits

References

Vulmon Search

About

Products

Connect