Published: 05/05/2016 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL prior to 1.0.1t and 1.0.2 prior to 1.0.2h allows remote malicious users to cause a denial of service (heap memory corruption) via a large amount of binary data.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
redhat enterprise linux hpc node 6
opensuse leap 42.1
opensuse opensuse 13.2
oracle mysql
redhat enterprise linux desktop 7.0
redhat enterprise linux server aus 7.2
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux hpc node 7.0
redhat enterprise linux server eus 7.2
redhat enterprise linux hpc node eus 7.2
apple mac os x 10.11.5
openssl openssl 1.0.1m
openssl openssl 1.0.2a
openssl openssl 1.0.1j
openssl openssl 1.0.1
openssl openssl 1.0.1h
openssl openssl 1.0.2e
openssl openssl 1.0.1r
openssl openssl 1.0.2b
openssl openssl 1.0.1c
openssl openssl 1.0.1g
openssl openssl 1.0.2g
openssl openssl 1.0.1a
openssl openssl 1.0.1d
openssl openssl 1.0.2c
openssl openssl 1.0.2
openssl openssl 1.0.1p
openssl openssl 1.0.1k
openssl openssl 1.0.1b
openssl openssl 1.0.1n
openssl openssl 1.0.1q
openssl openssl 1.0.1e
openssl openssl 1.0.1l
openssl openssl 1.0.1f
openssl openssl 1.0.1s
openssl openssl 1.0.1o
openssl openssl 1.0.2f
openssl openssl 1.0.1i
openssl openssl 1.0.2d
debian debian linux 8.0
canonical ubuntu linux 12.04
canonical ubuntu linux 16.04
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04
nodejs node.js
nodejs node.js 6.0.0

Synopsis Important: openssl security update Type/Severity Security Advisory: Important Topic An update for openssl is now available for Red Hat Enterprise Linux 67 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP 2423 Release Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services httpd 2423 is now available from the Red Hat Customer Portal for Solaris and Microsoft Windows systemsRed Hat Product Security has rated this release as ...

Several security issues were fixed in OpenSSL ...

Several vulnerabilities were discovered in OpenSSL, a Secure Socket Layer toolkit CVE-2016-2105 Guido Vranken discovered that an overflow can occur in the function EVP_EncodeUpdate(), used for Base64 encoding, if an attacker can supply a large amount of data This could lead to a heap corruption CVE-2016-2106 Guido Vranken discov ...

A vulnerability was discovered that allows a man-in-the-middle attacker to use a padding oracle attack to decrypt traffic on a connection using an AES CBC cipher with a server supporting AES-NI (CVE-2016-2107, Important) It was discovered that the ASN1 parser can misinterpret a large universal tag as a negative value If an application deserializ ...

An integer overflow flaw, leading to a buffer overflow, was found in the way the EVP_EncodeUpdate() function of OpenSSL parsed very large amounts of input data A remote attacker could use this flaw to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application ...

Nessus and SecurityCenter are potentially impacted by several vulnerabilities in OpenSSL that were recently disclosed and fixed Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to upgrade the included version of OpenSSL as a precaution, and to save time The issues include: CVE-2016-2107 - OpenSSL AES-N ...

The Log Correlation Engine (LCE) is potentially impacted by several vulnerabilities in OpenSSL (20160503), libpcre / PCRE, Libxml2, Handlebars, libcurl, and jQuery that were recently disclosed and fixed Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to upgrade the included versions of each library as a ...

Tenable's Passive Vulnerability Scanner (PVS) uses third-party libraries to provide certain standardized functionality Two of these libraries were found to contain vulnerabilities and were fixed upstream Those fixes have been integrated despite there being no known exploitation scenarios related to PVS OpenSSL ASN1 Encoder Negative Zero Value ...

Orion Elite Hidden IP Browser Pro versions 10 through 79 have insecure versions of Tor and OpenSSL included and also suffer from man-in-the-middle vulnerabilities ...

Security router changelog

The securityrouterorg project is a network operating system and software distribution based on OpenBSD which is developed and maintained by Halon Security New systems are deployed by downloading a software image The easiest way to update existing systems is to perform an automatic update from within the product's administration New major versions can contain configurat

Yay! It's International Patch Your Scary OpenSSL Bugs Day!

The Register • Iain Thomson in San Francisco • 03 May 2016

Two innocent programming blunders breed high-risk flaw

Six security patches – two of them high severity – have been released today for OpenSSL 1.0.1 and 1.0.2. Last week, the open-source crypto-library project warned that a bunch of fixes were incoming, and true enough, Tuesday’s updates address serious flaws that should be installed as soon as possible. CVE-2016-2108 is a curious beast; a hybrid of two low-risk bugs that can be fused into a serious problem. The first is a seemingly innocuous issue with the ASN.1 parser whereby if a zero is re...

CVE-2016-2105

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Exploits

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect