CVE-2016-2105
high · 7.5Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.
7.5
CVSS
39.6%
EPSS (exploit prob.)
99th
EPSS percentile
2016-05-05
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-190
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| redhat | enterprise_linux_desktop | 6.0 |
| redhat | enterprise_linux_hpc_node | 6 |
| redhat | enterprise_linux_server | 6.0 |
| redhat | enterprise_linux_workstation | 6.0 |
| opensuse | leap | 42.1 |
| opensuse | opensuse | 13.2 |
| oracle | mysql | >= 5.6.0, <= 5.6.30 |
| oracle | mysql | >= 5.7.0, <= 5.7.12 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_hpc_node | 7.0 |
| redhat | enterprise_linux_hpc_node_eus | 7.2 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_server_aus | 7.2 |
| redhat | enterprise_linux_server_eus | 7.2 |
| redhat | enterprise_linux_workstation | 7.0 |
| apple | mac_os_x | 10.11.5 |
| openssl | openssl | 1.0.1 |
| openssl | openssl | 1.0.1 |
| openssl | openssl | 1.0.1 |
| openssl | openssl | 1.0.1 |
| openssl | openssl | 1.0.1a |
| openssl | openssl | 1.0.1b |
| openssl | openssl | 1.0.1c |
| openssl | openssl | 1.0.1d |
| openssl | openssl | 1.0.1e |
| openssl | openssl | 1.0.1f |
| openssl | openssl | 1.0.1g |
| openssl | openssl | 1.0.1h |
| openssl | openssl | 1.0.1i |
| openssl | openssl | 1.0.1j |
| openssl | openssl | 1.0.1k |
| openssl | openssl | 1.0.1l |
| openssl | openssl | 1.0.1m |
| openssl | openssl | 1.0.1n |
| openssl | openssl | 1.0.1o |
| openssl | openssl | 1.0.1p |
| openssl | openssl | 1.0.1q |
| openssl | openssl | 1.0.1r |
| openssl | openssl | 1.0.1s |
| openssl | openssl | 1.0.2 |
Check a specific version with /api/v1/cve/match.
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html
- http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html
- http://rhn.redhat.com/errata/RHSA-2016-0722.html
- http://rhn.redhat.com/errata/RHSA-2016-0996.html
- http://rhn.redhat.com/errata/RHSA-2016-1648.html
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2016-2105