CVE-2016-2108

EPSS 77.91%
Veröffentlicht 05.05.2016 01:59:04
Zuletzt bearbeitet 06.05.2026 22:30:45
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 62

NVD 40 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Redhat ≫ Enterprise Linux Desktop Version6.0

Redhat ≫ Enterprise Linux Hpc Node Version6.0

Redhat ≫ Enterprise Linux Server Version6.0

Redhat ≫ Enterprise Linux Workstation Version6.0

OpenSSL ≫ OpenSSL Version <= 1.0.1n

OpenSSL ≫ OpenSSL Version1.0.2

OpenSSL ≫ OpenSSL Version1.0.2 Updatebeta1

OpenSSL ≫ OpenSSL Version1.0.2 Updatebeta2

OpenSSL ≫ OpenSSL Version1.0.2 Updatebeta3

OpenSSL ≫ OpenSSL Version1.0.2a

OpenSSL ≫ OpenSSL Version1.0.2b

Redhat ≫ Enterprise Linux Desktop Version7.0

Redhat ≫ Enterprise Linux Hpc Node Version7.0

Redhat ≫ Enterprise Linux Hpc Node Eus Version7.2

Redhat ≫ Enterprise Linux Server Version7.0

Redhat ≫ Enterprise Linux Server Aus Version7.2

Redhat ≫ Enterprise Linux Server Eus Version7.2

Redhat ≫ Enterprise Linux Workstation Version7.0

Google ≫ Android Version4.0

Google ≫ Android Version4.0.1

Google ≫ Android Version4.0.2

Google ≫ Android Version4.0.3

Google ≫ Android Version4.0.4

Google ≫ Android Version4.1

Google ≫ Android Version4.1.2

Google ≫ Android Version4.2

Google ≫ Android Version4.2.1

Google ≫ Android Version4.2.2

Google ≫ Android Version4.3

Google ≫ Android Version4.3.1

Google ≫ Android Version4.4

Google ≫ Android Version4.4.1

Google ≫ Android Version4.4.2

Google ≫ Android Version4.4.3

Google ≫ Android Version5.0

Google ≫ Android Version5.0.1

Google ≫ Android Version5.1

Google ≫ Android Version5.1.0

Google ≫ Android Version6.0

Google ≫ Android Version6.0.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	77.91%	0.995

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://rhn.redhat.com/errata/RHSA-2016-2957.html

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://source.android.com/security/bulletin/2016-07-01.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://www.securityfocus.com/bid/91787

http://rhn.redhat.com/errata/RHSA-2016-2056.html

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html

https://support.apple.com/HT206903

https://www.tenable.com/security/tns-2016-18

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html

http://rhn.redhat.com/errata/RHSA-2016-0722.html

http://rhn.redhat.com/errata/RHSA-2016-0996.html

http://rhn.redhat.com/errata/RHSA-2016-2073.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html

http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl

http://www.debian.org/security/2016/dsa-3566

http://www.securitytracker.com/id/1035721

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103

http://www.ubuntu.com/usn/USN-2959-1

https://bto.bluecoat.com/security-advisory/sa123

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us

https://security.gentoo.org/glsa/201612-16

https://security.netapp.com/advisory/ntap-20160504-0001/

https://www.openssl.org/news/secadv/20160503.txt

Vendor Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202

http://support.citrix.com/article/CTX212736

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862

http://www.securityfocus.com/bid/89752

https://access.redhat.com/errata/RHSA-2016:1137

https://access.redhat.com/errata/RHSA-2017:0193

https://access.redhat.com/errata/RHSA-2017:0194

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3661bb4e7934668bd99ca777ea8b30eedfafa871

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067&languageid=en-fr

https://nvd.nist.gov/vuln/detail/CVE-2016-2108

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-2108

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-2108

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2016-2108