CVE-2016-2109

Published: May 5, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

Affected (23)

Products: Openssl: Openssl · Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Hpc Node Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Workstation

Openssl

1 product

Openssl

Redhat

7 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Hpc Node Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Workstation

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 1.0.1s
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2 beta2
Openssl Openssl	Version 1.0.2 beta3
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e
Openssl Openssl	Version 1.0.2f
Openssl Openssl	Version 1.0.2g

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Hpc Node Eus	Version 7.2
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Eus	Version 7.2
Redhat Enterprise Linux Workstation	Version 7.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Hpc Node	Version 6.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Workstation	Version 6.0

Related CWEs

CWE-399

References (110)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html

Source: secalert@redhat.com

http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0722.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0996.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2056.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2073.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3566

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/87940

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

http://www.securitytracker.com/id/1035721

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2959-1

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa123

Source: secalert@redhat.com

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c62981390d6cf9e3d612c489b8b77c2913b25807

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

Source: secalert@redhat.com

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10160

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201612-16

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20160504-0001/

Source: secalert@redhat.com

https://source.android.com/security/bulletin/2017-07-01

Source: secalert@redhat.com

https://support.apple.com/HT206903

Source: secalert@redhat.com

https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc

Source: secalert@redhat.com

https://www.openssl.org/news/secadv/20160503.txt

Source: secalert@redhat.com

Vendor Advisory

https://www.tenable.com/security/tns-2016-18

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759