CVE-2016-2106

CWE-189CWE-190 — Integer OverflowCWE-122 — Heap-based Buffer OverflowCWE-119 — Buffer OverflowCWE-200 — Information ExposureCWE-31019 documents13 sources
Severity
7.5HIGH
EPSS
67.3%
top 1.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Openssl OpensslRedhat Enterprise Linux DesktopRedhat Enterprise Linux HPC Node+5 more
Timeline
PublishedMay 5
Latest updateMay 14

Description

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶Debianopenssl< 1.0.2h-1+3
▶NVDopenssl/openssl1.0.1s+8

Also affects: Enterprise Linux 7.2

🔴Vulnerability Details

3
GHSA
GHSA-j7jq-c44j-q74h: Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc↗2022-05-14
▶
CVEList
CVE-2016-2106: Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc↗2016-05-05
▶
OSV
CVE-2016-2106: Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc↗2016-05-05
▶

💥Exploits & PoCs

2
Metasploit
Microsoft Exchange ProxyLogon Collector↗
▶
Metasploit
Microsoft Exchange ProxyLogon Scanner↗
▶

📋Vendor Advisories

6
Apple
CVE-2016-2106: OS X El Capitan v10.11.6 and Security Update 2016-004↗2016-07-18
▶
BSD
FreeBSD-SA-16:17.openssl: Multiple OpenSSL vulnerabilities↗2016-05-04
▶
Cisco
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016↗2016-05-04
▶
Red Hat
openssl: EVP_EncryptUpdate overflow↗2016-05-03
▶
Ubuntu
OpenSSL vulnerabilities↗2016-05-03
▶

💬Community

7
Bugzilla
CVE-2016-2106 openssl: EVP_EncryptUpdate overflow [jbews-2.1.0]↗2016-05-18
▶
HackerOne
EVP_EncryptUpdate overflow (CVE-2016-2106)↗2016-05-03
▶
Bugzilla
CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 mingw-openssl: various flaws [epel-7]↗2016-05-03
▶
Bugzilla
CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 openssl: various flaws [fedora-all]↗2016-05-03
▶
Bugzilla
CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 mingw-openssl: various flaws [fedora-all]↗2016-05-03
▶
CVE-2016-2106 (HIGH CVSS 7.5) | Integer overflow in the EVP_Encrypt | cvebase.io