CVE-2016-2842

critical · 9.8

The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799.

9.8

CVSS

53.7%

EPSS (exploit prob.)

99th

EPSS percentile

2016-03-03

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-119

Affected products

Vendor	Product	Affected versions
openssl	openssl	1.0.1
openssl	openssl	1.0.1
openssl	openssl	1.0.1
openssl	openssl	1.0.1
openssl	openssl	1.0.1a
openssl	openssl	1.0.1b
openssl	openssl	1.0.1c
openssl	openssl	1.0.1d
openssl	openssl	1.0.1e
openssl	openssl	1.0.1f
openssl	openssl	1.0.1g
openssl	openssl	1.0.1h
openssl	openssl	1.0.1i
openssl	openssl	1.0.1j
openssl	openssl	1.0.1k
openssl	openssl	1.0.1l
openssl	openssl	1.0.1m
openssl	openssl	1.0.1n
openssl	openssl	1.0.1o
openssl	openssl	1.0.1p
openssl	openssl	1.0.1q
openssl	openssl	1.0.1r
openssl	openssl	1.0.2
openssl	openssl	1.0.2
openssl	openssl	1.0.2
openssl	openssl	1.0.2
openssl	openssl	1.0.2a
openssl	openssl	1.0.2b
openssl	openssl	1.0.2c
openssl	openssl	1.0.2d
openssl	openssl	1.0.2e
openssl	openssl	1.0.2f

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-2842