CVE-2012-2110

Exploit

EPSS 48.3%
Veröffentlicht 19.04.2012 17:55:01
Zuletzt bearbeitet 16.06.2026 23:41:00
Erkennungen
Login

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 42

NVD 91 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

OpenSSL ≫ OpenSSL Version 1.0.0

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta1

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta2

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta3

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta4

OpenSSL ≫ OpenSSL Version 1.0.0 Update beta5

OpenSSL ≫ OpenSSL Version 1.0.0a

OpenSSL ≫ OpenSSL Version 1.0.0b

OpenSSL ≫ OpenSSL Version 1.0.0c

OpenSSL ≫ OpenSSL Version 1.0.0d

OpenSSL ≫ OpenSSL Version 1.0.0e

OpenSSL ≫ OpenSSL Version 1.0.0g

OpenSSL ≫ OpenSSL Version <= 0.9.8u

OpenSSL ≫ OpenSSL Version 0.9.1c

OpenSSL ≫ OpenSSL Version 0.9.2b

OpenSSL ≫ OpenSSL Version 0.9.3

OpenSSL ≫ OpenSSL Version 0.9.3a

OpenSSL ≫ OpenSSL Version 0.9.4

OpenSSL ≫ OpenSSL Version 0.9.5

OpenSSL ≫ OpenSSL Version 0.9.5 Update beta1

OpenSSL ≫ OpenSSL Version 0.9.5 Update beta2

OpenSSL ≫ OpenSSL Version 0.9.5a

OpenSSL ≫ OpenSSL Version 0.9.5a Update beta1

OpenSSL ≫ OpenSSL Version 0.9.5a Update beta2

OpenSSL ≫ OpenSSL Version 0.9.6

OpenSSL ≫ OpenSSL Version 0.9.6 Update beta1

OpenSSL ≫ OpenSSL Version 0.9.6 Update beta2

OpenSSL ≫ OpenSSL Version 0.9.6 Update beta3

OpenSSL ≫ OpenSSL Version 0.9.6a

OpenSSL ≫ OpenSSL Version 0.9.6a Update beta1

OpenSSL ≫ OpenSSL Version 0.9.6a Update beta2

OpenSSL ≫ OpenSSL Version 0.9.6a Update beta3

OpenSSL ≫ OpenSSL Version 0.9.6b

OpenSSL ≫ OpenSSL Version 0.9.6c

OpenSSL ≫ OpenSSL Version 0.9.6d

OpenSSL ≫ OpenSSL Version 0.9.6e

OpenSSL ≫ OpenSSL Version 0.9.6f

OpenSSL ≫ OpenSSL Version 0.9.6g

OpenSSL ≫ OpenSSL Version 0.9.6h

OpenSSL ≫ OpenSSL Version 0.9.6i

OpenSSL ≫ OpenSSL Version 0.9.6j

OpenSSL ≫ OpenSSL Version 0.9.6k

OpenSSL ≫ OpenSSL Version 0.9.6l

OpenSSL ≫ OpenSSL Version 0.9.6m

OpenSSL ≫ OpenSSL Version 0.9.7

OpenSSL ≫ OpenSSL Version 0.9.7 Update beta1

OpenSSL ≫ OpenSSL Version 0.9.7 Update beta2

OpenSSL ≫ OpenSSL Version 0.9.7 Update beta3

OpenSSL ≫ OpenSSL Version 0.9.7 Update beta4

OpenSSL ≫ OpenSSL Version 0.9.7 Update beta5

OpenSSL ≫ OpenSSL Version 0.9.7 Update beta6

OpenSSL ≫ OpenSSL Version 0.9.7a

OpenSSL ≫ OpenSSL Version 0.9.7b

OpenSSL ≫ OpenSSL Version 0.9.7c

OpenSSL ≫ OpenSSL Version 0.9.7d

OpenSSL ≫ OpenSSL Version 0.9.7e

OpenSSL ≫ OpenSSL Version 0.9.7f

OpenSSL ≫ OpenSSL Version 0.9.7g

OpenSSL ≫ OpenSSL Version 0.9.7h

OpenSSL ≫ OpenSSL Version 0.9.7i

OpenSSL ≫ OpenSSL Version 0.9.7j

OpenSSL ≫ OpenSSL Version 0.9.7k

OpenSSL ≫ OpenSSL Version 0.9.7l

OpenSSL ≫ OpenSSL Version 0.9.7m

OpenSSL ≫ OpenSSL Version 0.9.8

OpenSSL ≫ OpenSSL Version 0.9.8a

OpenSSL ≫ OpenSSL Version 0.9.8b

OpenSSL ≫ OpenSSL Version 0.9.8c

OpenSSL ≫ OpenSSL Version 0.9.8d

OpenSSL ≫ OpenSSL Version 0.9.8e

OpenSSL ≫ OpenSSL Version 0.9.8f

OpenSSL ≫ OpenSSL Version 0.9.8g

OpenSSL ≫ OpenSSL Version 0.9.8h

OpenSSL ≫ OpenSSL Version 0.9.8i

OpenSSL ≫ OpenSSL Version 0.9.8j

OpenSSL ≫ OpenSSL Version 0.9.8k

OpenSSL ≫ OpenSSL Version 0.9.8l

OpenSSL ≫ OpenSSL Version 0.9.8m

OpenSSL ≫ OpenSSL Version 0.9.8m Update beta1

OpenSSL ≫ OpenSSL Version 0.9.8n

OpenSSL ≫ OpenSSL Version 0.9.8o

OpenSSL ≫ OpenSSL Version 0.9.8p

OpenSSL ≫ OpenSSL Version 0.9.8q

OpenSSL ≫ OpenSSL Version 0.9.8r

OpenSSL ≫ OpenSSL Version 0.9.8s

OpenSSL ≫ OpenSSL Version 0.9.8t

Redhat ≫ OpenSSL Version 0.9.6-15

Redhat ≫ OpenSSL Version 0.9.6b-3

Redhat ≫ OpenSSL Version 0.9.7a-2

OpenSSL ≫ OpenSSL Version 1.0.1 Update beta1

OpenSSL ≫ OpenSSL Version 1.0.1 Update beta2

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	48.3%	0.987

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://secunia.com/advisories/57353

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

http://support.apple.com/kb/HT5784

http://marc.info/?l=bugtraq&m=133951357207000&w=2

https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

http://marc.info/?l=bugtraq&m=134039053214295&w=2

http://rhn.redhat.com/errata/RHSA-2012-1306.html

http://rhn.redhat.com/errata/RHSA-2012-1307.html

http://rhn.redhat.com/errata/RHSA-2012-1308.html

http://marc.info/?l=bugtraq&m=133728068926468&w=2

http://secunia.com/advisories/48899

http://www.ubuntu.com/usn/USN-1424-1

http://secunia.com/advisories/48895

http://www.debian.org/security/2012/dsa-2454

http://secunia.com/advisories/48999

http://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578

http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.html

Exploit

http://cvs.openssl.org/chngview?cn=22431

http://cvs.openssl.org/chngview?cn=22434

http://cvs.openssl.org/chngview?cn=22439

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079149.html

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079299.html

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080176.html

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00015.html

http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.html

http://osvdb.org/81223

http://rhn.redhat.com/errata/RHSA-2012-0518.html

http://rhn.redhat.com/errata/RHSA-2012-0522.html

http://secunia.com/advisories/48847

http://secunia.com/advisories/48942

http://www.exploit-db.com/exploits/18756

http://www.mandriva.com/security/advisories?name=MDVSA-2012:060

http://www.openssl.org/news/secadv_20120419.txt

Vendor Advisory

http://www.securityfocus.com/bid/53158

http://www.securitytracker.com/id?1026957

https://kb.juniper.net/KB27376

https://nvd.nist.gov/vuln/detail/CVE-2012-2110

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2012-2110

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2012-2110

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2012-2110