7.5
CVSSv3

CVE-2016-0797

Published: 03/03/2016 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Multiple integer overflows in OpenSSL 1.0.1 prior to 1.0.1s and 1.0.2 prior to 1.0.2g allow remote malicious users to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openssl openssl 1.0.1m

openssl openssl 1.0.2a

openssl openssl 1.0.1j

openssl openssl 1.0.1

openssl openssl 1.0.1h

openssl openssl 1.0.2e

openssl openssl 1.0.1r

openssl openssl 1.0.2b

openssl openssl 1.0.1c

openssl openssl 1.0.1g

openssl openssl 1.0.1a

openssl openssl 1.0.1d

openssl openssl 1.0.2c

openssl openssl 1.0.2

openssl openssl 1.0.1p

openssl openssl 1.0.1k

openssl openssl 1.0.1b

openssl openssl 1.0.1n

openssl openssl 1.0.1q

openssl openssl 1.0.1e

openssl openssl 1.0.1l

openssl openssl 1.0.1f

openssl openssl 1.0.1o

openssl openssl 1.0.2f

openssl openssl 1.0.1i

openssl openssl 1.0.2d

nodejs node.js

canonical ubuntu linux 15.10

canonical ubuntu linux 14.04

canonical ubuntu linux 12.04

debian debian linux 8.0

debian debian linux 7.0

Vendor Advisories

Synopsis Important: Red Hat JBoss Core Services Apache HTTP 2423 Release Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services httpd 2423 is now available from the Red Hat Customer Portal for Solaris and Microsoft Windows systemsRed Hat Product Security has rated this release as ...
Several security issues were fixed in OpenSSL ...
A padding oracle flaw was found in the Secure Sockets Layer version 20 (SSLv2) protocol An attacker can potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections This cross-protocol attack is publicly referred to as DROWN (CVE-2016-0800) Pri ...
Nessus is potentially impacted by several vulnerabilities in OpenSSL that were recently disclosed and fixed Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to upgrade the included version of OpenSSL as a precaution, and to save time The issues include: CVE-2016-0800 Secure Sockets Layer Version 2 (SSL ...

Exploits

Orion Elite Hidden IP Browser Pro versions 10 through 79 have insecure versions of Tor and OpenSSL included and also suffer from man-in-the-middle vulnerabilities ...

References

NVD-CWE-Otherhttp://openssl.org/news/secadv/20160301.txthttps://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlhttps://kc.mcafee.com/corporate/index?page=content&id=SB10156http://www.securityfocus.com/bid/91787https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990http://marc.info/?l=bugtraq&m=145889460330120&w=2http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlhttp://www.securityfocus.com/bid/83763http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.htmlhttps://www.openssl.org/news/secadv/20160301.txthttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.htmlhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-opensslhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.htmlhttp://www.debian.org/security/2016/dsa-3500https://security.gentoo.org/glsa/201603-15http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.htmlhttp://www.ubuntu.com/usn/USN-2914-1http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_ushttp://www.securitytracker.com/id/1035133https://security.FreeBSD.org/advisories/FreeBSD-SA-16:12.openssl.aschttp://rhn.redhat.com/errata/RHSA-2016-2957.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c175308407858afff3fc8c2e5e085d94d12edc7dhttps://access.redhat.com/errata/RHSA-2016:2957https://nvd.nist.govhttps://usn.ubuntu.com/2914-1/https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-21