Vulnerability Details : CVE-2016-2105
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.
Vulnerability category: OverflowMemory CorruptionDenial of service
Products affected by CVE-2016-2105
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:1.0.1s:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
- cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
- cpe:2.3:a:nodejs:node.js:6.0.0:*:*:*:-:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-2105
8.66%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-2105
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2016-2105
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-2105
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
HPSBMU03691 rev.1 - HPE Insight Control, Multiple Remote VulnerabilitiesThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html
[security-announce] SUSE-SU-2016:1267-1: important: Security update forMailing List;Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20160504-0001/
May 2016 OpenSSL Vulnerabilities in Multiple NetApp Products | NetApp Product SecurityThird Party Advisory
-
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016Third Party Advisory
-
https://security.gentoo.org/glsa/201612-16
OpenSSL: Multiple vulnerabilities (GLSA 201612-16) — Gentoo securityThird Party Advisory
-
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103
The Slackware Linux Project: Slackware Security AdvisoriesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2959-1
USN-2959-1: OpenSSL vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://support.apple.com/HT206903
About the security content of OS X El Capitan v10.11.6 and Security Update 2016-004 - Apple SupportThird Party Advisory
-
https://www.openssl.org/news/secadv/20160503.txt
Vendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-2073.html
RHSA-2016:2073 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.securitytracker.com/id/1035721
OpenSSL Multiple Bugs Let Remote Users Decrypt Data, Deny Service, Obtain Potentially Sensitive Information, and Potentially Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
http://rhn.redhat.com/errata/RHSA-2016-1650.html
Red Hat Customer PortalThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html
[security-announce] openSUSE-SU-2016:1242-1: important: Security updateMailing List;Third Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
[SECURITY] Fedora 22 Update: openssl-1.0.1k-15.fc22Mailing List;Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-2056.html
Red Hat Customer PortalThird Party Advisory
-
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
Apple - Lists.apple.comMailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/91787
Oracle July 2016 Critical Patch Update Multiple VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
Oracle Critical Patch Update - January 2018Patch;Vendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-2957.html
RHSA-2016:2957 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
[SECURITY] Fedora 23 Update: openssl-1.0.2h-1.fc23Mailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html
[security-announce] SUSE-SU-2016:1231-1: important: Security update forMailing List;Third Party Advisory
-
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Oracle Solaris Bulletin - April 2016Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html
[security-announce] openSUSE-SU-2016:1273-1: important: Security updateMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html
[security-announce] openSUSE-SU-2016:1241-1: important: Security updateMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
[security-announce] openSUSE-SU-2016:1240-1: important: Security updateMailing List;Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-0722.html
RHSA-2016:0722 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
[security-announce] SUSE-SU-2016:1206-1: important: Security update forMailing List;Third Party Advisory
-
http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html
Slackware Security Advisory - openssl Updates ≈ Packet StormThird Party Advisory;VDB Entry
-
https://bto.bluecoat.com/security-advisory/sa123
SA123 : OpenSSL Vulnerabilities 3-May-2016Third Party Advisory
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10160
McAfee Security Bulletin: McAfee product updates fix vulnerabilities in OpenSSL that can allow an attacker to decrypt the traffic, corrupt the heap, and cause a denial of serviceThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-1648.html
RHSA-2016:1648 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Oracle Critical Patch Update - July 2016Patch;Third Party Advisory
-
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us
HPESBHF03765 rev.1 - HPE ConvergedSystem 700 Solution with Comware v7 Switches using OpenSSL, Remote Denial of Service (DoS) and Disclosure of Sensitive InformationThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html
[security-announce] SUSE-SU-2016:1360-1: important: Security update forMailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/89757
OpenSSL CVE-2016-2105 Buffer Overflow VulnerabilityThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
Oracle Linux Bulletin - April 2016Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
[security-announce] openSUSE-SU-2016:1238-1: important: Security updateMailing List;Third Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Oracle Critical Patch Update - October 2016Patch;Vendor Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
[SECURITY] Fedora 24 Update: openssl-1.0.2h-1.fc24Mailing List;Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-0996.html
RHSA-2016:0996 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
HPSBMU03653 rev.1 - HPE System Management Homepage (SMH), Remote Arbitrary Code Execution, Cross-Site Scripting (XSS), Denial of Service (DoS), Unauthorized Disclosure of InformationVendor Advisory
-
https://www.tenable.com/security/tns-2016-18
[R7] LCE 4.8.1 Fixes Multiple Vulnerabilities - Security Advisory | Tenable®Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html
[security-announce] SUSE-SU-2016:1290-1: important: Security update forMailing List;Third Party Advisory
-
https://source.android.com/security/bulletin/pixel/2017-11-01
Pixel / Nexus Security Bulletin—November 2017 | Android Open Source ProjectThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
[security-announce] openSUSE-SU-2016:1243-1: important: Security updateMailing List;Third Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
CPU July 2018Patch;Vendor Advisory
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016Vendor Advisory
-
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html
[security-announce] openSUSE-SU-2016:1566-1: important: Security updateThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
[security-announce] SUSE-SU-2016:1233-1: important: Security update forMailing List;Third Party Advisory
-
https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc
Third Party Advisory
-
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us
HPESBHF03756 rev.1 - HPE Network Products including Comware 7, iMC, and VCX running OpenSSL, Remote Denial of Service (DoS), Disclosure of Sensitive InformationThird Party Advisory
-
http://www.debian.org/security/2016/dsa-3566
Debian -- Security Information -- DSA-3566-1 opensslThird Party Advisory
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
Juniper Networks - 2016-10 Security Bulletin: OpenSSL security updatesThird Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Oracle Critical Patch Update - July 2017Patch;Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
[security-announce] SUSE-SU-2016:1228-1: important: Security update forMailing List;Third Party Advisory
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Oracle Linux Bulletin - July 2016Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
[security-announce] openSUSE-SU-2016:1237-1: important: Security updateMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html
[security-announce] openSUSE-SU-2016:1239-1: important: Security updateMailing List;Third Party Advisory
-
https://git.openssl.org/?p=openssl.git;a=commit;h=5b814481f3573fa9677f3a31ee51322e2a22ee6a
git.openssl.org Git - openssl.git/commitIssue Tracking;Patch;Vendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-1649.html
RHSA-2016:1649 - Security Advisory - Red Hat Customer PortalThird Party Advisory
Jump to