ID CVE-2016-0797
Summary Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c. <a href="http://cwe.mitre.org/data/definitions/190.html">CWE-190: Integer Overflow or Wraparound</a> <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a>
References
Vulnerable Configurations
  • cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 05-01-2018 - 02:30)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
redhat via4
advisories
rhsa
id RHSA-2016:2957
rpms
  • openssl-0:1.0.1e-42.el6_7.4
  • openssl-devel-0:1.0.1e-42.el6_7.4
  • openssl-perl-0:1.0.1e-42.el6_7.4
  • openssl-static-0:1.0.1e-42.el6_7.4
  • openssl-1:1.0.1e-51.el7_2.4
  • openssl-devel-1:1.0.1e-51.el7_2.4
  • openssl-libs-1:1.0.1e-51.el7_2.4
  • openssl-perl-1:1.0.1e-51.el7_2.4
  • openssl-static-1:1.0.1e-51.el7_2.4
  • openssl-0:0.9.8e-39.el5_11
  • openssl-devel-0:0.9.8e-39.el5_11
  • openssl-perl-0:0.9.8e-39.el5_11
refmap via4
bid
  • 83763
  • 91787
cisco 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016
confirm
debian DSA-3500
freebsd FreeBSD-SA-16:12
gentoo GLSA-201603-15
hp HPSBGN03563
sectrack 1035133
suse
  • SUSE-SU-2016:0617
  • SUSE-SU-2016:0620
  • SUSE-SU-2016:0621
  • SUSE-SU-2016:0624
  • SUSE-SU-2016:0631
  • SUSE-SU-2016:0641
  • SUSE-SU-2016:0678
  • SUSE-SU-2016:1057
  • openSUSE-SU-2016:0627
  • openSUSE-SU-2016:0628
  • openSUSE-SU-2016:0637
  • openSUSE-SU-2016:0638
  • openSUSE-SU-2016:0640
  • openSUSE-SU-2016:0720
  • openSUSE-SU-2016:1239
  • openSUSE-SU-2016:1241
  • openSUSE-SU-2016:1566
ubuntu USN-2914-1
Last major update 05-01-2018 - 02:30
Published 03-03-2016 - 20:59
Back to Top