CVE-2016-0797

Published: Mar 3, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.

Affected (40)

Products: Openssl: Openssl · Nodejs: Node.js · Canonical: Ubuntu Linux · +1 more

Show all products

Openssl: Openssl · Nodejs: Node.js · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

1 product

1 product

1 product

Configuration A

32 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j
Openssl Openssl	Version 1.0.1k
Openssl Openssl	Version 1.0.1l
Openssl Openssl	Version 1.0.1m
Openssl Openssl	Version 1.0.1n
Openssl Openssl	Version 1.0.1o
Openssl Openssl	Version 1.0.1p
Openssl Openssl	Version 1.0.1q
Openssl Openssl	Version 1.0.1r
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2 beta2
Openssl Openssl	Version 1.0.2 beta3
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e
Openssl Openssl	Version 1.0.2f

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 5.0.0 to 5.7.1
Nodejs Node.js	From 4.0.0 to 4.1.2
Nodejs Node.js	From 4.2.0 to 4.3.2

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

References (88)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00005.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=145889460330120&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://openssl.org/news/secadv/20160301.txt

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

Third Party Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-openssl

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3500

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/83763

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1035133

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2914-1

Source: secalert@redhat.com

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c175308407858afff3fc8c2e5e085d94d12edc7d

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

Source: secalert@redhat.com

Third Party Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10156

Source: secalert@redhat.com

Third Party Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:12.openssl.asc

Source: secalert@redhat.com

Third Party Advisory

https://security.gentoo.org/glsa/201603-15

Source: secalert@redhat.com

Third Party Advisory

https://www.openssl.org/news/secadv/20160301.txt

Source: secalert@redhat.com

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759