Published: 30/01/2017 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cryptopp crypto\\+\\+ 5.6.4
debian debian linux 8.0

Debian Bug report logs - #848009 libcrypto++: CVE-2016-9939: denial-of-service in ASN1 decoder Package: src:libcrypto++; Maintainer for src:libcrypto++ is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 13 Dec 2016 05:54:01 UTC Severity: important Tags: secu ...

Gergely Gábor Nagy from Tresorit discovered that libcrypto++, a C++ cryptographic library, contained a bug in several ASN1 parsing routines This would allow an attacker to remotely cause a denial of service For the stable distribution (jessie), this problem has been fixed in version 561-6+deb8u3 For the testing (stretch) and unstable (sid) d ...

Snyk C/C++ Test using Snyk Test API This is a proof of concept using experimental Snyk Test API for C and C++ packages The purpose of this project is to validate our assumptions about package identifications and gather feedback before commiting to a stable API WARNING: The API is experimental and will change! Getting started Set SNYK_TOKEN environment variable to contain your

CWE-20 http://www.securityfocus.com/bid/94854 http://www.openwall.com/lists/oss-security/2016/12/12/7 http://www.debian.org/security/2016/dsa-3748 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848009 https://nvd.nist.gov https://www.debian.org/security/./dsa-3748

CVE-2016-9939

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect