CVE-2016-0797 : Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a deni

Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.

Published 2016-03-03 20:59:02

Updated 2022-12-13 12:15:19

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Memory CorruptionDenial of service

Exploit prediction scoring system (EPSS) score for CVE-2016-0797

Probability of exploitation activity in the next 30 days: 19.32%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 96 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2016-0797

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2016-0797

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

HPSBMU03691 rev.1 - HPE Insight Control, Multiple Remote Vulnerabilities
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html

[security-announce] openSUSE-SU-2016:0638-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us

HPESBHF03741 rev.1 - HPE Network products including Comware 7, IMC, and VCX running OpenSSL, Local Unauthorized Disclosure of Information, Remote Denial of Service (DoS), Unauthorized Disclosure of In
Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/83763

OpenSSL CVE-2016-0797 Multiple Integer Overflow Vulnerabilities
Third Party Advisory;VDB Entry
http://www.debian.org/security/2016/dsa-3500

Debian -- Security Information -- DSA-3500-1 openssl
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html

[security-announce] SUSE-SU-2016:0620-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
https://kc.mcafee.com/corporate/index?page=content&id=SB10156

McAfee Security Bulletin: McAfee Web Gateway update fixes multiple vulnerabilities
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html

[security-announce] SUSE-SU-2016:0617-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html

[security-announce] SUSE-SU-2016:0631-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

[security-announce] openSUSE-SU-2016:0640-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1035133

OpenSSL Flaws Let Remote Users Deny Service and Decrypt TLS Sessions in Certain Cases - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:12.openssl.asc

Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

cpuapr2016v3
Patch;Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/91787

Oracle July 2016 Critical Patch Update Multiple Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00005.html

[security-announce] openSUSE-SU-2016:0627-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2957.html

RHSA-2016:2957 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/201603-15

OpenSSL: Multiple vulnerabilities (GLSA 201603-15) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html

[security-announce] SUSE-SU-2016:0621-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Oracle Solaris Bulletin - April 2016
Third Party Advisory

CVEs referencing this url
https://www.openssl.org/news/secadv/20160301.txt

Vendor Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html

[security-announce] openSUSE-SU-2016:1241-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2914-1

USN-2914-1: OpenSSL vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html

[security-announce] openSUSE-SU-2016:0628-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html

[security-announce] SUSE-SU-2016:0624-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
https://git.openssl.org/?p=openssl.git;a=commit;h=c175308407858afff3fc8c2e5e085d94d12edc7d

git.openssl.org Git - openssl.git/commit
Vendor Advisory
http://openssl.org/news/secadv/20160301.txt

Vendor Advisory

CVEs referencing this url
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917

HPSBMU03685 rev.1 - HPE Insight Control server provisioning (ICsp), Multiple Remote Vulnerabilities
Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Oracle Critical Patch Update - July 2016
Patch;Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Oracle Linux Bulletin - January 2016
Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Oracle Solaris Bulletin - January 2016
Third Party Advisory

CVEs referencing this url
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-openssl

Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016
Third Party Advisory

CVEs referencing this url
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168

Pulse Security Advisory: SA40168 - [Pulse Secure] March 1st 2016 OpenSSL Security Advisory
Third Party Advisory

CVEs referencing this url
http://marc.info/?l=bugtraq&m=145889460330120&w=2

'[security bulletin] HPSBGN03563 rev.1 - HPE IceWall Products using OpenSSL, Remote Denial of Service' - MARC
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html

[security-announce] openSUSE-SU-2016:0637-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html

[security-announce] SUSE-SU-2016:1057-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html

[security-announce] openSUSE-SU-2016:0720-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Oracle VM Server for x86 Bulletin - July 2016
Third Party Advisory

CVEs referencing this url
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html

[security-announce] openSUSE-SU-2016:1566-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html

[security-announce] SUSE-SU-2016:0678-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Juniper Networks - 2016-10 Security Bulletin: OpenSSL security updates
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html

[security-announce] openSUSE-SU-2016:1239-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html

[security-announce] SUSE-SU-2016:0641-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990

HPSBGN03563 rev.3 - HPE IceWall Products using OpenSSL, Remote Denial of Service (DoS), Local Denial of Service (DoS), Disclosure of Information
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2016-0797

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1f
cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1 Update Beta2
cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1 Update Beta1
cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1c
cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1b
cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1e
cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1d
cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1
cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1a
cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1 Update Beta3
cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1g
cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1h
cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1i
cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1j
cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2 Update Beta3
cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2 Update Beta1
cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2
cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2 Update Beta2
cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1l
cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1k
cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1m
cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2a
cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2b
cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2c
cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1n
cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1o
cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2d
cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2e
cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1q
cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1p
cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.2f
cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1r
cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.10
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Matching versions
Nodejs » Node.js
Versions from including (>=) 5.0.0 and before (<) 5.7.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 4.0.0 and before (<) 4.1.2
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Nodejs » Node.js » LTS Edition
Versions from including (>=) 4.2.0 and before (<) 4.3.2
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Matching versions

Vulnerability Details : CVE-2016-0797

Exploit prediction scoring system (EPSS) score for CVE-2016-0797

CVSS scores for CVE-2016-0797

References for CVE-2016-0797

Products affected by CVE-2016-0797