CVE-2016-2109

CWE-399CWE-20 — Improper Input ValidationCWE-119 — Buffer OverflowCWE-200 — Information ExposureCWE-31016 documents13 sources
Severity
7.5HIGH
EPSS
57.9%
top 1.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Openssl OpensslRedhat Enterprise Linux DesktopRedhat Enterprise Linux HPC Node+5 more
Timeline
PublishedMay 5
Latest updateMay 14

Description

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶Debianopenssl< 1.0.2h-1+3
▶NVDopenssl/openssl1.0.1s+8

Also affects: Enterprise Linux 7.2

🔴Vulnerability Details

3
GHSA
GHSA-mq63-fmfx-8qc3: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp↗2022-05-14
▶
OSV
CVE-2016-2109: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp↗2016-05-05
▶
CVEList
CVE-2016-2109: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp↗2016-05-05
▶

📋Vendor Advisories

7
Android
CVE-2016-2109: Android Security Bulletin 2017-07-01 CVE: CVE-2016-2109 Severity: HIGH Type: DoS Affected AOSP versions: 4↗2017-07-01
▶
Apple
CVE-2016-2109: OS X El Capitan v10.11.6 and Security Update 2016-004↗2016-07-18
▶
BSD
FreeBSD-SA-16:17.openssl: Multiple OpenSSL vulnerabilities↗2016-05-04
▶
Cisco
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016↗2016-05-04
▶
Ubuntu
OpenSSL vulnerabilities↗2016-05-03
▶

💬Community

5
HackerOne
ASN.1 BIO excessive memory allocation (CVE-2016-2109)↗2016-05-03
▶
Bugzilla
CVE-2016-2109 mingw-openssl: openssl: ASN.1 BIO handling of large amounts of data [fedora-all]↗2016-04-25
▶
Bugzilla
CVE-2016-2109 openssl101e: openssl: ASN.1 BIO handling of large amounts of data [epel-5]↗2016-04-25
▶
Bugzilla
CVE-2016-2109 openssl: ASN.1 BIO handling of large amounts of data [fedora-all]↗2016-04-25
▶
Bugzilla
CVE-2016-2109 openssl: ASN.1 BIO handling of large amounts of data↗2016-04-25
▶
CVE-2016-2109 (HIGH CVSS 7.5) | The asn1_d2i_read_bio function in c | cvebase.io