CVE-2016-2105

Severity

50%

Complexity

99%

Confidentiality

48%

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.

CVSS 3.0 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P).

Overview

First reported 8 years ago

2016-05-05 01:59:00

Last updated 6 years ago

2019-02-21 15:09:00

Affected Software

Red Hat Enterprise Linux Desktop 6.0

6.0

Red Hat Enterprise Linux Server 6.0

6.0

Red Hat Enterprise Linux Workstation 6.0

6.0

openSUSE Leap 42.1

42.1

OpenSUSE 13.2

13.2

Oracle MySQL -

RedHat Enterprise Linux Desktop 7.0

7.0

RedHat Enterprise Linux HPC Node 7.0

7.0

Red Hat Enterprise Linux HPC Node EUS 7.2

7.2

RedHat Enterprise Linux Server 7.0

7.0

Red Hat Enterprise Linux Server AUS 7.2

7.2

Red Hat Enterprise Linux Server EUS 7.2

7.2

RedHat Enterprise Linux Workstation 7.0

7.0

Apple Mac OS X 10.11.5

10.11.5

OpenSSL Project OpenSSL 1.0.1

1.0.1

OpenSSL Project OpenSSL 1.0.1 Beta1

1.0.1

OpenSSL Project OpenSSL 1.0.1 Beta2

1.0.1

OpenSSL Project OpenSSL 1.0.1 Beta3

1.0.1

OpenSSL Project OpenSSL 1.0.1a

1.0.1a

OpenSSL Project OpenSSL 1.0.1b

1.0.1b

OpenSSL Project OpenSSL 1.0.1c

1.0.1c

OpenSSL Project OpenSSL 1.0.1d

1.0.1d

OpenSSL Project OpenSSL 1.0.1e

1.0.1e

OpenSSL Project OpenSSL 1.0.1f

1.0.1f

OpenSSL Project OpenSSL 1.0.1g

1.0.1g

OpenSSL Project OpenSSL 1.0.1h

1.0.1h

OpenSSL Project OpenSSL 1.0.1i

1.0.1i

OpenSSL Project OpenSSL 1.0.1j

1.0.1j

OpenSSL Project OpenSSL 1.0.1k

1.0.1k

OpenSSL Project OpenSSL 1.0.1l

1.0.1l

OpenSSL OpenSSL 1.0.1m

1.0.1m

OpenSSL Project OpenSSL 1.0.1n

1.0.1n

OpenSSL Project OpenSSL 1.0.1o

1.0.1o

OpenSSL OpenSSL 1.0.1p

1.0.1p

OpenSSL 1.0.1q

1.0.1q

OpenSSL 1.0.1r

1.0.1r

OpenSSL Project 1.0.1s

1.0.1s

OpenSSL Project OpenSSL 1.0.2

1.0.2

OpenSSL Project OpenSSL 1.0.2-beta1

1.0.2

OpenSSL 1.0.2 Beta 2

1.0.2

OpenSSL 1.0.2 Beta 3

1.0.2

OpenSSL OpenSSL 1.0.2a

1.0.2a

OpenSSL Project OpenSSL 1.0.2b

1.0.2b

OpenSSL Project OpenSSL 1.0.2c

1.0.2c

OpenSSL OpenSSL 1.0.2d

1.0.2d

OpenSSL 1.0.2e

1.0.2e

OpenSSL 1.0.2f

1.0.2f

OpenSSL Project 1.0.2g

1.0.2g

Debian Linux 8.0 (Jessie)

8.0

Canonical Ubuntu Linux 12.04 LTS

12.04

Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)

14.04

Canonical Ubuntu Linux 15.10

15.10

Canonical Ubuntu Linux 16.04 LTS (Long-Term Support)

16.04

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Third Party Advisory

APPLE-SA-2016-07-18-1

Mailing List, Third Party Advisory

FEDORA-2016-05c567df1a

Mailing List, Third Party Advisory

FEDORA-2016-1411324654

Mailing List, Third Party Advisory

FEDORA-2016-1e39d934ed

Mailing List, Third Party Advisory

SUSE-SU-2016:1206

Mailing List, Third Party Advisory

SUSE-SU-2016:1228

Mailing List, Third Party Advisory

SUSE-SU-2016:1231

Mailing List, Third Party Advisory

SUSE-SU-2016:1233

Mailing List, Third Party Advisory

openSUSE-SU-2016:1237

Mailing List, Third Party Advisory

openSUSE-SU-2016:1238

Mailing List, Third Party Advisory

openSUSE-SU-2016:1239

Mailing List, Third Party Advisory

openSUSE-SU-2016:1240

Mailing List, Third Party Advisory

openSUSE-SU-2016:1241

Mailing List, Third Party Advisory

openSUSE-SU-2016:1242

Mailing List, Third Party Advisory

openSUSE-SU-2016:1243

Mailing List, Third Party Advisory

SUSE-SU-2016:1267

Mailing List, Third Party Advisory

openSUSE-SU-2016:1273

Mailing List, Third Party Advisory

SUSE-SU-2016:1290

Mailing List, Third Party Advisory

SUSE-SU-2016:1360

Mailing List, Third Party Advisory

openSUSE-SU-2016:1566

Third Party Advisory

http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html

Third Party Advisory, VDB Entry

RHSA-2016:0722

Third Party Advisory

RHSA-2016:0996

Third Party Advisory

RHSA-2016:1648

Third Party Advisory

RHSA-2016:1649

Third Party Advisory

RHSA-2016:1650

Third Party Advisory

RHSA-2016:2056

Third Party Advisory

RHSA-2016:2073

Third Party Advisory

RHSA-2016:2957

Third Party Advisory

20160504 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016

Third Party Advisory

DSA-3566

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Patch, Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Patch, Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Patch, Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Patch, Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Patch, Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Vendor Advisory

89757

Third Party Advisory, VDB Entry

91787

Third Party Advisory, VDB Entry

1035721

Third Party Advisory, VDB Entry

SSA:2016-124-01

Third Party Advisory

USN-2959-1

Third Party Advisory

https://bto.bluecoat.com/security-advisory/sa123

Third Party Advisory

https://git.openssl.org/?p=openssl.git;a=commit;h=5b814481f3573fa9677f3a31ee51322e2a22ee6a

Issue Tracking, Patch, Vendor Advisory

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us

Third Party Advisory

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

Vendor Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10160

Third Party Advisory

GLSA-201612-16

Third Party Advisory

https://security.netapp.com/advisory/ntap-20160504-0001/

Third Party Advisory

https://source.android.com/security/bulletin/pixel/2017-11-01

Third Party Advisory

https://support.apple.com/HT206903

Third Party Advisory

FreeBSD-SA-16:17

Third Party Advisory

https://www.openssl.org/news/secadv/20160503.txt

Vendor Advisory

https://www.tenable.com/security/tns-2016-18

Third Party Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.