Published: 05/05/2016 Updated: 07/11/2023

CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 695

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL prior to 1.0.1t and 1.0.2 prior to 1.0.2h allows remote malicious users to cause a denial of service (memory consumption) via a short invalid encoding.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl 1.0.2a
openssl openssl 1.0.2e
openssl openssl 1.0.2b
openssl openssl 1.0.2g
openssl openssl 1.0.2c
openssl openssl 1.0.2
openssl openssl
openssl openssl 1.0.2f
openssl openssl 1.0.2d
redhat enterprise linux desktop 7.0
redhat enterprise linux server aus 7.2
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux hpc node 7.0
redhat enterprise linux server eus 7.2
redhat enterprise linux hpc node eus 7.2
redhat enterprise linux hpc node 6.0
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0

Synopsis Important: openssl security update Type/Severity Security Advisory: Important Topic An update for openssl is now available for Red Hat Enterprise Linux 67 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP 2423 Release Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services httpd 2423 is now available from the Red Hat Customer Portal for Solaris and Microsoft Windows systemsRed Hat Product Security has rated this release as ...

Several security issues were fixed in OpenSSL ...

Several vulnerabilities were discovered in OpenSSL, a Secure Socket Layer toolkit CVE-2016-2105 Guido Vranken discovered that an overflow can occur in the function EVP_EncodeUpdate(), used for Base64 encoding, if an attacker can supply a large amount of data This could lead to a heap corruption CVE-2016-2106 Guido Vranken discov ...

A vulnerability was discovered that allows a man-in-the-middle attacker to use a padding oracle attack to decrypt traffic on a connection using an AES CBC cipher with a server supporting AES-NI (CVE-2016-2107, Important) It was discovered that the ASN1 parser can misinterpret a large universal tag as a negative value If an application deserializ ...

A denial of service flaw was found in the way OpenSSL parsed certain ASN1-encoded data from BIO (OpenSSL's I/O abstraction) inputs An application using OpenSSL that accepts untrusted ASN1 BIO input could be forced to allocate an excessive amount of data ...

Nessus and SecurityCenter are potentially impacted by several vulnerabilities in OpenSSL that were recently disclosed and fixed Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to upgrade the included version of OpenSSL as a precaution, and to save time The issues include: CVE-2016-2107 - OpenSSL AES-N ...

The Log Correlation Engine (LCE) is potentially impacted by several vulnerabilities in OpenSSL (20160503), libpcre / PCRE, Libxml2, Handlebars, libcurl, and jQuery that were recently disclosed and fixed Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to upgrade the included versions of each library as a ...

Tenable's Passive Vulnerability Scanner (PVS) uses third-party libraries to provide certain standardized functionality Two of these libraries were found to contain vulnerabilities and were fixed upstream Those fixes have been integrated despite there being no known exploitation scenarios related to PVS OpenSSL ASN1 Encoder Negative Zero Value ...

Orion Elite Hidden IP Browser Pro versions 10 through 79 have insecure versions of Tor and OpenSSL included and also suffer from man-in-the-middle vulnerabilities ...

Yay! It's International Patch Your Scary OpenSSL Bugs Day!

The Register • Iain Thomson in San Francisco • 03 May 2016

Two innocent programming blunders breed high-risk flaw

Six security patches – two of them high severity – have been released today for OpenSSL 1.0.1 and 1.0.2. Last week, the open-source crypto-library project warned that a bunch of fixes were incoming, and true enough, Tuesday’s updates address serious flaws that should be installed as soon as possible. CVE-2016-2108 is a curious beast; a hybrid of two low-risk bugs that can be fused into a serious problem. The first is a seemingly innocuous issue with the ASN.1 parser whereby if a zero is re...

CVE-2016-2109

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Exploits

Recent Articles

References

Vulmon Search

About

Products

Connect