CVE-2016-2177

EPSS 44.51%
Veröffentlicht 20.06.2016 01:59:02
Zuletzt bearbeitet 06.05.2026 22:30:45
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 67

NVD 39 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Hp ≫ Icewall Mcrp Version3.0

Hp ≫ Icewall Sso Version10.0 SwEditioncertd

Hp ≫ Icewall Sso Version10.0 SwEditiondfw

Hp ≫ Icewall Sso Agent Option Version10.0

OpenSSL ≫ OpenSSL Version1.0.1

OpenSSL ≫ OpenSSL Version1.0.1a

OpenSSL ≫ OpenSSL Version1.0.1b

OpenSSL ≫ OpenSSL Version1.0.1c

OpenSSL ≫ OpenSSL Version1.0.1d

OpenSSL ≫ OpenSSL Version1.0.1e

OpenSSL ≫ OpenSSL Version1.0.1f

OpenSSL ≫ OpenSSL Version1.0.1g

OpenSSL ≫ OpenSSL Version1.0.1h

OpenSSL ≫ OpenSSL Version1.0.1i

OpenSSL ≫ OpenSSL Version1.0.1j

OpenSSL ≫ OpenSSL Version1.0.1k

OpenSSL ≫ OpenSSL Version1.0.1l

OpenSSL ≫ OpenSSL Version1.0.1m

OpenSSL ≫ OpenSSL Version1.0.1n

OpenSSL ≫ OpenSSL Version1.0.1o

OpenSSL ≫ OpenSSL Version1.0.1p

OpenSSL ≫ OpenSSL Version1.0.1q

OpenSSL ≫ OpenSSL Version1.0.1r

OpenSSL ≫ OpenSSL Version1.0.1s

OpenSSL ≫ OpenSSL Version1.0.1t

OpenSSL ≫ OpenSSL Version1.0.2

OpenSSL ≫ OpenSSL Version1.0.2a

OpenSSL ≫ OpenSSL Version1.0.2b

OpenSSL ≫ OpenSSL Version1.0.2c

OpenSSL ≫ OpenSSL Version1.0.2d

OpenSSL ≫ OpenSSL Version1.0.2e

OpenSSL ≫ OpenSSL Version1.0.2f

OpenSSL ≫ OpenSSL Version1.0.2g

OpenSSL ≫ OpenSSL Version1.0.2h

Oracle ≫ Linux Version5

Oracle ≫ Linux Version6

Oracle ≫ Linux Version7

Oracle ≫ Solaris Version10

Oracle ≫ Solaris Version11.3

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	44.51%	0.986

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2957.html

https://www.tenable.com/security/tns-2016-20

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Third Party Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

Third Party Advisory

https://security.gentoo.org/glsa/201612-16

Patch

Third Party Advisory

VDB Entry

https://access.redhat.com/errata/RHSA-2017:0193

https://access.redhat.com/errata/RHSA-2017:0194

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

http://rhn.redhat.com/errata/RHSA-2016-1940.html

http://rhn.redhat.com/errata/RHSA-2017-1659.html

http://seclists.org/fulldisclosure/2017/Jul/31

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl

http://www.debian.org/security/2016/dsa-3673

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

http://www.openwall.com/lists/oss-security/2016/06/08/9

http://www.securityfocus.com/archive/1/540957/100/0/threaded

http://www.securityfocus.com/archive/1/archive/1/540957/100/0/threaded

http://www.securityfocus.com/bid/91319

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1036088

Third Party Advisory

VDB Entry

http://www.splunk.com/view/SP-CAAAPSV

Third Party Advisory

http://www.splunk.com/view/SP-CAAAPUE

Third Party Advisory

http://www.ubuntu.com/usn/USN-3087-1

http://www.ubuntu.com/usn/USN-3087-2

http://www.ubuntu.com/usn/USN-3181-1

https://access.redhat.com/errata/RHSA-2017:1658

https://bto.bluecoat.com/security-advisory/sa132

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1341705

Patch

Issue Tracking

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=a004e72b95835136d3f1ea90517f706c24c03da7

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03763en_us

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448

Third Party Advisory

https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10165

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

https://support.f5.com/csp/article/K23873366

https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager

https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/

https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/

https://www.tenable.com/security/tns-2016-16

Third Party Advisory

https://www.tenable.com/security/tns-2016-21

https://nvd.nist.gov/vuln/detail/CVE-2016-2177

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-2177

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-2177

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2016-2177