CVE-2016-2108

Published: May 5, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.

Affected (40)

Products: Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Hpc Node Eus, Enterprise Linux Server Aus, Enterprise Linux Server Eus · Openssl: Openssl · Google: Android

Redhat

7 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Server

Enterprise Linux Workstation

Enterprise Linux Hpc Node Eus

Enterprise Linux Server Aus

Enterprise Linux Server Eus

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Hpc Node	Version 6.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Workstation	Version 6.0

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 1.0.1n
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2 beta2
Openssl Openssl	Version 1.0.2 beta3
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Hpc Node Eus	Version 7.2
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Eus	Version 7.2
Redhat Enterprise Linux Workstation	Version 7.0

Configuration D

22 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 4.0.1
Google Android	Version 4.0.2
Google Android	Version 4.0.3
Google Android	Version 4.0.4
Google Android	Version 4.0
Google Android	Version 4.1.2
Google Android	Version 4.1
Google Android	Version 4.2.1
Google Android	Version 4.2.2
Google Android	Version 4.2
Google Android	Version 4.3.1
Google Android	Version 4.3
Google Android	Version 4.4.1
Google Android	Version 4.4.2
Google Android	Version 4.4.3
Google Android	Version 4.4
Google Android	Version 5.0.1
Google Android	Version 5.0
Google Android	Version 5.1.0
Google Android	Version 5.1
Google Android	Version 6.0.1
Google Android	Version 6.0

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (118)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html

Source: secalert@redhat.com

http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0722.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0996.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2056.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2073.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

http://source.android.com/security/bulletin/2016-07-01.html

Source: secalert@redhat.com

http://support.citrix.com/article/CTX212736

Source: secalert@redhat.com

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3566

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/89752

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

http://www.securitytracker.com/id/1035721

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2959-1

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2016:1137

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:0193

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:0194

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa123

Source: secalert@redhat.com

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3661bb4e7934668bd99ca777ea8b30eedfafa871

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804

Source: secalert@redhat.com

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202

Source: secalert@redhat.com

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067&languageid=en-fr

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201612-16

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20160504-0001/

Source: secalert@redhat.com

https://support.apple.com/HT206903

Source: secalert@redhat.com

https://www.openssl.org/news/secadv/20160503.txt

Source: secalert@redhat.com

Vendor Advisory

https://www.tenable.com/security/tns-2016-18

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759