CVE-2016-0799

EPSS 32.41%
Veröffentlicht 03.03.2016 20:59:03
Zuletzt bearbeitet 06.05.2026 22:30:45
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 62

NVD 35 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

OpenSSL ≫ OpenSSL Version1.0.1

OpenSSL ≫ OpenSSL Version1.0.1 Updatebeta1

OpenSSL ≫ OpenSSL Version1.0.1 Updatebeta2

OpenSSL ≫ OpenSSL Version1.0.1 Updatebeta3

OpenSSL ≫ OpenSSL Version1.0.1a

OpenSSL ≫ OpenSSL Version1.0.1b

OpenSSL ≫ OpenSSL Version1.0.1c

OpenSSL ≫ OpenSSL Version1.0.1d

OpenSSL ≫ OpenSSL Version1.0.1e

OpenSSL ≫ OpenSSL Version1.0.1f

OpenSSL ≫ OpenSSL Version1.0.1g

OpenSSL ≫ OpenSSL Version1.0.1h

OpenSSL ≫ OpenSSL Version1.0.1i

OpenSSL ≫ OpenSSL Version1.0.1j

OpenSSL ≫ OpenSSL Version1.0.1k

OpenSSL ≫ OpenSSL Version1.0.1l

OpenSSL ≫ OpenSSL Version1.0.1m

OpenSSL ≫ OpenSSL Version1.0.1n

OpenSSL ≫ OpenSSL Version1.0.1o

OpenSSL ≫ OpenSSL Version1.0.1p

OpenSSL ≫ OpenSSL Version1.0.1q

OpenSSL ≫ OpenSSL Version1.0.1r

OpenSSL ≫ OpenSSL Version1.0.2

OpenSSL ≫ OpenSSL Version1.0.2 Updatebeta1

OpenSSL ≫ OpenSSL Version1.0.2 Updatebeta2

OpenSSL ≫ OpenSSL Version1.0.2 Updatebeta3

OpenSSL ≫ OpenSSL Version1.0.2a

OpenSSL ≫ OpenSSL Version1.0.2b

OpenSSL ≫ OpenSSL Version1.0.2c

OpenSSL ≫ OpenSSL Version1.0.2d

OpenSSL ≫ OpenSSL Version1.0.2e

OpenSSL ≫ OpenSSL Version1.0.2f

Pulsesecure ≫ Client Version- SwPlatformandroid

Pulsesecure ≫ Client Version- SwPlatformiphone_os

Pulsesecure ≫ Steel Belted Radius Version-

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	32.41%	0.981

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

http://rhn.redhat.com/errata/RHSA-2016-2957.html

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://marc.info/?l=bugtraq&m=145983526810210&w=2

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681

http://www.securityfocus.com/bid/91787

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html

http://marc.info/?l=bugtraq&m=146108058503441&w=2

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-openssl

http://www.securitytracker.com/id/1035133

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:12.openssl.asc

https://security.gentoo.org/glsa/201603-15

https://www.openssl.org/news/secadv/20160301.txt

http://openssl.org/news/secadv/20160301.txt

Vendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178358.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178817.html

http://www.debian.org/security/2016/dsa-3500

http://www.ubuntu.com/usn/USN-2914-1

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05126404

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05135617

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150736

http://rhn.redhat.com/errata/RHSA-2016-0722.html

http://rhn.redhat.com/errata/RHSA-2016-0996.html

http://rhn.redhat.com/errata/RHSA-2016-2073.html

http://www.securityfocus.com/bid/83755

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=578b956fe741bf8e84055547b1e83c28dd902c73

https://nvd.nist.gov/vuln/detail/CVE-2016-0799

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-0799

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-0799

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2016-0799