CVE-2016-6304

Published: Sep 26, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

Affected (41)

Products: Openssl: Openssl · Nodejs: Node.js · Novell: Suse Linux Enterprise Module For Web Scripting

1 product

1 product

1 product

Suse Linux Enterprise Module For Web Scripting

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2 beta2
Openssl Openssl	Version 1.0.2 beta3
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e
Openssl Openssl	Version 1.0.2f
Openssl Openssl	Version 1.0.2h

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.1.0

Configuration C

24 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j
Openssl Openssl	Version 1.0.1k
Openssl Openssl	Version 1.0.1l
Openssl Openssl	Version 1.0.1m
Openssl Openssl	Version 1.0.1n
Openssl Openssl	Version 1.0.1o
Openssl Openssl	Version 1.0.1p
Openssl Openssl	Version 1.0.1q
Openssl Openssl	Version 1.0.1r
Openssl Openssl	Version 1.0.1s
Openssl Openssl	Version 1.0.1t

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 0.10.0 to 0.10.47
Nodejs Node.js	From 0.12.0 to 0.12.16
Nodejs Node.js	From 4.0.0 to 4.6.0
Nodejs Node.js	From 6.0.0 to 6.7.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Novell Suse Linux Enterprise Module For Web Scripting	Version 12.0

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (124)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://rhn.redhat.com/errata/RHSA-2016-1940.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2802.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-1415.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-1659.html

Source: secalert@redhat.com

Third Party Advisory

http://seclists.org/fulldisclosure/2016/Dec/47

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2016/Oct/62

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2017/Jul/31

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3673

Source: secalert@redhat.com

Third Party Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/93150

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1036878

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037640

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.splunk.com/view/SP-CAAAPSV

Source: secalert@redhat.com

Third Party Advisory

http://www.splunk.com/view/SP-CAAAPUE

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-3087-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-3087-2

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1413

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1414

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1658

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1801

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1802

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2493

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2494

Source: secalert@redhat.com

Third Party Advisory

https://bto.bluecoat.com/security-advisory/sa132

Source: secalert@redhat.com

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137

Source: secalert@redhat.com

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10171

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

Source: secalert@redhat.com

Third Party Advisory

https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

Source: secalert@redhat.com

Third Party Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

Source: secalert@redhat.com

Third Party Advisory

https://security.gentoo.org/glsa/201612-16

Source: secalert@redhat.com

Third Party Advisory

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

Source: secalert@redhat.com

Third Party Advisory

https://www.openssl.org/news/secadv/20160922.txt

Source: secalert@redhat.com

Vendor Advisory

https://www.tenable.com/security/tns-2016-16

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-20

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-21

Source: secalert@redhat.com

Third Party Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759