CVE-2016-2182

Published: Sep 16, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

Affected (38)

Products: Hp: Icewall Federation Agent, Icewall Mcrp, Icewall Sso, Icewall Sso Agent Option · Openssl: Openssl · Oracle: Linux

4 products

Icewall Federation Agent

Icewall Mcrp

Icewall Sso

Icewall Sso Agent Option

1 product

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Hp Icewall Federation Agent	Version 3.0
Hp Icewall Mcrp	Version 3.0
Hp Icewall Sso	Version 10.0
Hp Icewall Sso	Version 10.0
Hp Icewall Sso Agent Option	Version 10.0

Configuration B

30 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j
Openssl Openssl	Version 1.0.1k
Openssl Openssl	Version 1.0.1l
Openssl Openssl	Version 1.0.1m
Openssl Openssl	Version 1.0.1n
Openssl Openssl	Version 1.0.1o
Openssl Openssl	Version 1.0.1p
Openssl Openssl	Version 1.0.1q
Openssl Openssl	Version 1.0.1r
Openssl Openssl	Version 1.0.1s
Openssl Openssl	Version 1.0.1t
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e
Openssl Openssl	Version 1.0.2f
Openssl Openssl	Version 1.0.2g
Openssl Openssl	Version 1.0.2h

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Linux	Version 5
Oracle Linux	Version 6
Oracle Linux	Version 7

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (104)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1940.html

Source: secalert@redhat.com

http://seclists.org/fulldisclosure/2017/Jul/31

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3673

Source: secalert@redhat.com

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/92557

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1036688

Source: secalert@redhat.com

http://www.securitytracker.com/id/1037968

Source: secalert@redhat.com

http://www.splunk.com/view/SP-CAAAPSV

Source: secalert@redhat.com

Third Party Advisory

http://www.splunk.com/view/SP-CAAAPUE

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-3087-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-3087-2

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2018:2185

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2018:2186

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2018:2187

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa132

Source: secalert@redhat.com

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448

Source: secalert@redhat.com

Third Party Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10171

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

Source: secalert@redhat.com

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

Source: secalert@redhat.com

https://source.android.com/security/bulletin/2017-03-01

Source: secalert@redhat.com

https://source.android.com/security/bulletin/2017-03-01.html

Source: secalert@redhat.com

https://support.f5.com/csp/article/K01276005

Source: secalert@redhat.com

https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us

Source: secalert@redhat.com

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us

Source: secalert@redhat.com

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

Source: secalert@redhat.com

https://www.tenable.com/security/tns-2016-16

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-20

Source: secalert@redhat.com

https://www.tenable.com/security/tns-2016-21

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759