CVE-2016-2106

Published: May 5, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

Affected (23)

Products: Openssl: Openssl · Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Hpc Node Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Workstation

Openssl

1 product

Openssl

Redhat

7 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Hpc Node Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Workstation

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	version ≤ 1.0.1s
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2 beta2
Openssl Openssl	Version 1.0.2 beta3
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e
Openssl Openssl	Version 1.0.2f
Openssl Openssl	Version 1.0.2g

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Hpc Node Eus	Version 7.2
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Eus	Version 7.2
Redhat Enterprise Linux Workstation	Version 7.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Hpc Node	Version 6.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Workstation	Version 6.0

Related CWEs

CWE-189

References (122)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html

Source: secalert@redhat.com

http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0722.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0996.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1648.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1649.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1650.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2056.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2073.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3566

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/89744

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

http://www.securitytracker.com/id/1035721

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2959-1

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa123

Source: secalert@redhat.com

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3f3582139fbb259a1c3cbb0a25236500a409bf26

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

Source: secalert@redhat.com

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10160

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201612-16

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20160504-0001/

Source: secalert@redhat.com

https://source.android.com/security/bulletin/pixel/2017-11-01

Source: secalert@redhat.com

https://support.apple.com/HT206903

Source: secalert@redhat.com

https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc

Source: secalert@redhat.com

https://www.openssl.org/news/secadv/20160503.txt

Source: secalert@redhat.com

Vendor Advisory

https://www.tenable.com/security/tns-2016-18

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759