CVE-2016-6306
published 2016-09-26CVE-2016-6306: The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via…
PriorityP338medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
41.68%
98.5th percentile
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
Affected
53 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | openssl | < openssl 1.0.2i-1 (bookworm) | openssl 1.0.2i-1 (bookworm) |
| hp | icewall_federation_agent | — | — |
| hp | icewall_mcrp | — | — |
| hp | icewall_sso | — | — |
| hp | icewall_sso_agent_option | — | — |
| nodejs | node.js | >= 0.10.0 < 0.10.47 | 0.10.47 |
| nodejs | node.js | >= 0.12.0 < 0.12.16 | 0.12.16 |
| nodejs | node.js | 4.0.0 – 4.1.2 | — |
| nodejs | node.js | >= 4.2.0 < 4.6.0 | 4.6.0 |
| nodejs | node.js | 5.0.0 – 5.12.0 | — |
| nodejs | node.js | >= 6.0.0 < 6.7.0 | 6.7.0 |
| novell | suse_linux_enterprise_module_for_web_scripting | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_cisco5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g89j-86gv-84w2: The certificate parser in OpenSSL before 1
ghsa_unreviewed·2022-05-13
CVE-2016-6306 [MEDIUM] CWE-125 GHSA-g89j-86gv-84w2: The certificate parser in OpenSSL before 1
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
OSV
CVE-2016-6306: The certificate parser in OpenSSL before 1
osv·2016-09-26·CVSS 5.9
CVE-2016-6306 [MEDIUM] CVE-2016-6306: The certificate parser in OpenSSL before 1
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
OSV
openssl regression
osv·2016-09-23·CVSS 9.8
CVE-2016-2182 [CRITICAL] openssl regression
openssl regression
USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was
incomplete and caused a regression when parsing certificates. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request
extension. A remote attacker could possibly use this issue to cause memory
consumption, resulting in a denial of service. (CVE-2016-6304)
Guido Vranken discovered that OpenSSL used undefined behaviour when
performing pointer arithmetic. A remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. This
issue has only been addressed in Ubuntu 16.04 LTS in this update.
(CVE-2016-2177)
César Pereida, Billy Brumley, and Y
OSV
openssl vulnerabilities
osv·2016-09-22·CVSS 9.8
CVE-2016-6304 [CRITICAL] openssl vulnerabilities
openssl vulnerabilities
Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request
extension. A remote attacker could possibly use this issue to cause memory
consumption, resulting in a denial of service. (CVE-2016-6304)
Guido Vranken discovered that OpenSSL used undefined behaviour when
performing pointer arithmetic. A remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. This
issue has only been addressed in Ubuntu 16.04 LTS in this update.
(CVE-2016-2177)
César Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL
did not properly use constant-time operations when performing DSA signing.
A remote attacker could possibly use this issue to perform a cache-timing
attack and recover private DSA keys. (CVE-201
CISA ICS
Siemens SCALANCE X-200RNA Switch Devices
cisa_ics·2022-12-19
Siemens SCALANCE X-200RNA Switch Devices
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE X-200RNA Switch Devices
Last RevisedDecember 19, 2022
Alert CodeICSA-22-349-21
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available
- Vendor: Siemens
- Equipment: SCALANCE X-200RNA switch devices before V3.2.7
- Vulnerabilities: Observable Timing Discrepancy; Race Condition; Improper Restriction of Operations within the Bounds of a Memory Buffer; Improper Input Validation; NULL Pointer Dereference; Use After Free; Cryptographic Issues; Comparison of Incompatible Types; Resource Management
Cisco
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016
vendor_cisco·2016-09-27·CVSS 5.5
CVE-2016-2177 [MEDIUM] CWE-119 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016
On September 22, 2016, the OpenSSL Software Foundation released an advisory that describes 14 vulnerabilities. Of these 14 vulnerabilities, the OpenSSL Software Foundation classifies one as “Critical Severity,” one as “Moderate Severity,” and the other 12 as “Low Severity.”
Subsequently, on September 26, the OpenSSL Software Foundation released an additional advisory that describes two new vulnerabilities. These vulnerabilities affect the OpenSSL versions that were released to address the vulnerabilities disclosed in the previous advisory. One of the new vulnerabilities was rated as “High Severity” and the other as “Moderate Severity.”
Of the 16 released vulnerabilities:
Fourteen track issues that could resu
Ubuntu
OpenSSL regression
vendor_ubuntu·2016-09-23·CVSS 9.8
CVE-2016-2182 [CRITICAL] OpenSSL regression
Title: OpenSSL regression
Summary: USN-3087-1 introduced a regression in OpenSSL.
USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was
incomplete and caused a regression when parsing certificates. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request
extension. A remote attacker could possibly use this issue to cause memory
consumption, resulting in a denial of service. (CVE-2016-6304)
Guido Vranken discovered that OpenSSL used undefined behaviour when
performing pointer arithmetic. A remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. This
issue has only been addressed in Ubuntu 16.04 LTS in t
BSD
FreeBSD-SA-16:26.openssl: Multiple OpenSSL vulnerabilities
bsd_advisories·2016-09-23·CVSS 9.8
CVE-2016-2177 [CRITICAL] FreeBSD-SA-16:26.openssl: Multiple OpenSSL vulnerabilities
FreeBSD-SA-16:26.openssl Security Advisory
The FreeBSD Project
Topic: Multiple OpenSSL vulnerabilities
Category: contrib
Module: openssl
Announced: 2016-09-23; revised on 2016-09-26
Credits: OpenSSL Project
Affects: All supported versions of FreeBSD.
Corrected: 2016-09-22 14:57:48 UTC (stable/11, 11.0-STABLE)
2016-09-22 15:55:27 UTC (releng/11.0, 11.0-RELEASE)
2016-09-22 15:05:38 UTC (stable/10, 10.3-STABLE)
2016-09-26 08:21:29 UTC (releng/10.3, 10.3-RELEASE-p9)
2016-09-26 08:21:29 UTC (releng/10.2, 10.2-RELEASE-p22)
2016-09-26 08:21:29 UTC (releng/10.1, 10.1-RELEASE-p39)
2016-09-26 08:19:33 UTC (stable/9, 9.3-STABLE)
2016-09-26 08:21:29 UTC (releng/9.3, 9.3-RELEASE-p47)
CVE Name: CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180,
CVE-2016-2181, CVE-2016-2182, CVE-2016-6302, CVE
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2016-09-22·CVSS 9.8
CVE-2016-2177 [CRITICAL] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request
extension. A remote attacker could possibly use this issue to cause memory
consumption, resulting in a denial of service. (CVE-2016-6304)
Guido Vranken discovered that OpenSSL used undefined behaviour when
performing pointer arithmetic. A remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. This
issue has only been addressed in Ubuntu 16.04 LTS in this update.
(CVE-2016-2177)
César Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL
did not properly use constant-time operations when performing DSA signing.
A remote attacker could possibly use this issue to perf
Red Hat
openssl: certificate message OOB reads
vendor_redhat·2016-09-21·CVSS 5.9
CVE-2016-6306 [MEDIUM] CWE-125 openssl: certificate message OOB reads
openssl: certificate message OOB reads
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL.
Package: openssl (Red Hat Enterprise Linux 4) - Will not fix
Package: openssl (Red Hat Enterprise Linux 5) - Will not fix
Package: openssl097a (Red Hat Enterprise Linux 5) - Will not fix
Package: openssl098e (Red Hat Enterprise Linux 6) - Will not fix
Package: openssl098e (Red Hat Enterprise Linux 7) - Will not f
Debian
CVE-2016-6306: openssl - The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might al...
vendor_debian·2016·CVSS 5.9
CVE-2016-6306 [MEDIUM] CVE-2016-6306: openssl - The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might al...
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
Scope: local
bookworm: resolved (fixed in 1.0.2i-1)
bullseye: resolved (fixed in 1.0.2i-1)
forky: resolved (fixed in 1.0.2i-1)
sid: resolved (fixed in 1.0.2i-1)
trixie: resolved (fixed in 1.0.2i-1)
Cisco
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016
vendor_cisco
CVE-2016-6306 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016
CVE-2016-6306: Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016
On September 22, 2016, the OpenSSL Software Foundation released an advisory that describes 14 vulnerabilities. Of these 14 vulnerabilities, the OpenSSL Software Foundation classifies one as “Critical Severity,” one as “Moderate Severity,” and the other 12 as “Low Severity.” Subsequently, on September 26, the OpenSSL Software Foundation released an additional advisory that describes two new vulnerabilities. These vulnerabilities affect the OpenSSL versions that were released to address the vulnerabilities disclosed in the previous advisory. One of the new vulnerabilities was rated as “High Severity” and the other as “Moderate Severity.” Of the 16 released vulnerabilities: Fourteen track issues that c
No detection rules found.
No public exploits indexed.
HackerOne
Certificate message OOB reads (CVE-2016-6306)
hackerone·2017-05-25·CVSS 5.9
CVE-2016-6306 [MEDIUM] Certificate message OOB reads (CVE-2016-6306)
Certificate message OOB reads (CVE-2016-6306)
In OpenSSL 1.0.2 and earlier some missing message length checks can result in
OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical
DoS risk but this has not been observed in practice on common platforms.
The messages affected are client certificate, client certificate request and
server certificate. As a result the attack can only be performed against
a client or a server which enables client authentication.
refer:
https://www.openssl.org/news/secadv/20160922.txt
In OpenSSL 1.0.2 and earlier some missing message length checks can result in OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical DoS risk but this has not been observed in practice on common platforms.
The messages affected are c
Bugzilla
RHSA-2016:1940: openssl security update
bugzilla·2016-11-02·CVSS 9.8
[CRITICAL] RHSA-2016:1940: openssl security update
RHSA-2016:1940: openssl security update
Description of problem:
atomic scan found a CVE bug in registry.access.redhat.com/rhel7/cockpit-ws:latest(b43b419e).
Version-Release number of selected component (if applicable):
[root@atomic-00 cloud-user]# cat /etc/redhat-release
Red Hat Enterprise Linux Atomic Host release 7.3
[root@atomic-00 cloud-user]# atomic host status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
Version: 7.3 (2016-10-26 14:24:09)
Commit: 90c9735becfff1c55c8586ae0f2c904bc0928f042cd4d016e9e0e2edd16e5e97
OSName: rhel-atomic-host
Unlocked: development
[root@atomic-00 cloud-user]# rpm -q atomic
atomic-1.13.6-1.el7.x86_64
[root@atomic-00 cloud-user]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
registry.access.redhat.com/rhel7/o
Bugzilla
CVE-2016-6304 CVE-2016-6306 openssl: various flaws [fedora-all]
bugzilla·2016-09-22·CVSS 7.5
CVE-2016-6304 [HIGH] CVE-2016-6304 CVE-2016-6306 openssl: various flaws [fedora-all]
CVE-2016-6304 CVE-2016-6306 openssl: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While
Bugzilla
CVE-2016-6304 CVE-2016-6306 openssl101e: various flaws [epel-5]
bugzilla·2016-09-22·CVSS 7.5
CVE-2016-6304 [HIGH] CVE-2016-6304 CVE-2016-6306 openssl101e: various flaws [epel-5]
CVE-2016-6304 CVE-2016-6306 openssl101e: various flaws [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Discussion:
U
Bugzilla
CVE-2016-6304 CVE-2016-6306 mingw-openssl: various flaws [fedora-all]
bugzilla·2016-09-22·CVSS 7.5
CVE-2016-6304 [HIGH] CVE-2016-6304 CVE-2016-6306 mingw-openssl: various flaws [fedora-all]
CVE-2016-6304 CVE-2016-6306 mingw-openssl: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora.
Bugzilla
CVE-2016-6304 CVE-2016-6306 mingw-openssl: various flaws [epel-7]
bugzilla·2016-09-22·CVSS 7.5
CVE-2016-6304 [HIGH] CVE-2016-6304 CVE-2016-6306 mingw-openssl: various flaws [epel-7]
CVE-2016-6304 CVE-2016-6306 mingw-openssl: various flaws [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Discussion:
Bugzilla
CVE-2016-6306 openssl: certificate message OOB reads
bugzilla·2016-09-20·CVSS 5.9
CVE-2016-6306 [MEDIUM] CVE-2016-6306 openssl: certificate message OOB reads
CVE-2016-6306 openssl: certificate message OOB reads
Quoting form the draft of the OpenSSL upstream advisory:
Certificate message OOB reads (CVE-2016-6306)
Severity: Low
In OpenSSL 1.0.2 and earlier some missing message length checks can result in
OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical
DoS risk but this has not been observed in practice on common platforms.
The messages affected are client certificate, client certificate request and
server certificate. As a result the attack can only be performed against
a client or a server which enables client authentication.
OpenSSL 1.1.0 is not affected.
OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u
This issue was reported to OpenSSL on 22nd August 2016 by Shi Le
arXiv
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
arxiv_fulltext·2022-12-29
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
## Abstract
Currently, the development of IoT firmware heavily depends on third-party components (TPCs) to improve development efficiency. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will influence the security of IoT firmware. Existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implement , which leverages syntactical features and control-flow graph features to detect the TPCs in firmware, and then recognizes the corresponding vulnerabilities. Based on , we present the first l
Tenable
[R7] Nessus 6.9 Fixes Multiple Vulnerabilities
blogs_tenable·2016-10-25
[R7] Nessus 6.9 Fixes Multiple Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1940.htmlhttp://seclists.org/fulldisclosure/2017/Jul/31http://www-01.ibm.com/support/docview.wss?uid=swg21995039http://www.debian.org/security/2016/dsa-3673http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-enhttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.htmlhttp://www.securityfocus.com/bid/93153http://www.securitytracker.com/id/1036885http://www.ubuntu.com/usn/USN-3087-1http://www.ubuntu.com/usn/USN-3087-2https://access.redhat.com/errata/RHSA-2018:2185https://access.redhat.com/errata/RHSA-2018:2186https://access.redhat.com/errata/RHSA-2018:2187https://bto.bluecoat.com/security-advisory/sa132https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312https://kc.mcafee.com/corporate/index?page=content&id=SB10215https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.aschttps://security.gentoo.org/glsa/201612-16https://support.f5.com/csp/article/K90492697https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_ushttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_ushttps://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24https://www.openssl.org/news/secadv/20160922.txthttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttps://www.tenable.com/security/tns-2016-16https://www.tenable.com/security/tns-2016-20https://www.tenable.com/security/tns-2016-21http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1940.htmlhttp://seclists.org/fulldisclosure/2017/Jul/31http://www-01.ibm.com/support/docview.wss?uid=swg21995039http://www.debian.org/security/2016/dsa-3673http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-enhttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.htmlhttp://www.securityfocus.com/bid/93153http://www.securitytracker.com/id/1036885http://www.ubuntu.com/usn/USN-3087-1http://www.ubuntu.com/usn/USN-3087-2https://access.redhat.com/errata/RHSA-2018:2185https://access.redhat.com/errata/RHSA-2018:2186https://access.redhat.com/errata/RHSA-2018:2187https://bto.bluecoat.com/security-advisory/sa132https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312https://kc.mcafee.com/corporate/index?page=content&id=SB10215https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.aschttps://security.gentoo.org/glsa/201612-16https://support.f5.com/csp/article/K90492697
+ 12 more references
2016-09-26
Published