CVE-2016-6306

Published: Sep 26, 2016Modified: May 6, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.

Affected (51)

Products: Openssl: Openssl · Hp: Icewall Federation Agent, Icewall Mcrp, Icewall Sso, Icewall Sso Agent Option · Novell: Suse Linux Enterprise Module For Web Scripting · +3 more

Show all products

Openssl: Openssl · Hp: Icewall Federation Agent, Icewall Mcrp, Icewall Sso, Icewall Sso Agent Option · Novell: Suse Linux Enterprise Module For Web Scripting · Nodejs: Node.js · Debian: Debian Linux · Canonical: Ubuntu Linux

Openssl

1 product

Openssl

4 products

Icewall Federation Agent

Icewall Mcrp

Icewall Sso

Icewall Sso Agent Option

Novell

1 product

Suse Linux Enterprise Module For Web Scripting

1 product

1 product

1 product

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j
Openssl Openssl	Version 1.0.1k
Openssl Openssl	Version 1.0.1l
Openssl Openssl	Version 1.0.1m
Openssl Openssl	Version 1.0.1n
Openssl Openssl	Version 1.0.1o
Openssl Openssl	Version 1.0.1p
Openssl Openssl	Version 1.0.1q
Openssl Openssl	Version 1.0.1r
Openssl Openssl	Version 1.0.1s
Openssl Openssl	Version 1.0.1t

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Hp Icewall Federation Agent	Version 3.0
Hp Icewall Mcrp	Version 3.0
Hp Icewall Sso	Version 10.0
Hp Icewall Sso	Version 10.0
Hp Icewall Sso Agent Option	Version 10.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Novell Suse Linux Enterprise Module For Web Scripting	Version 12.0

Configuration D

11 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2 beta2
Openssl Openssl	Version 1.0.2 beta3
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e
Openssl Openssl	Version 1.0.2f
Openssl Openssl	Version 1.0.2h

Configuration E

6 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 0.10.0 to 0.10.47
Nodejs Node.js	From 0.12.0 to 0.12.16
Nodejs Node.js	From 4.0.0 to 4.1.2
Nodejs Node.js	From 5.0.0 to 5.12.0
Nodejs Node.js	From 6.0.0 to 6.7.0
Nodejs Node.js	From 4.2.0 to 4.6.0

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration G

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (112)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1940.html

Source: secalert@redhat.com

Third Party Advisory

http://seclists.org/fulldisclosure/2017/Jul/31

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3673

Source: secalert@redhat.com

Third Party Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/93153

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1036885

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-3087-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-3087-2

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2185

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2186

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2187

Source: secalert@redhat.com

Third Party Advisory

https://bto.bluecoat.com/security-advisory/sa132

Source: secalert@redhat.com

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448

Source: secalert@redhat.com

Third Party Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

Source: secalert@redhat.com

Third Party Advisory

https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

Source: secalert@redhat.com

Vendor Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

Source: secalert@redhat.com

Third Party Advisory

https://security.gentoo.org/glsa/201612-16

Source: secalert@redhat.com

Third Party Advisory

https://support.f5.com/csp/article/K90492697

Source: secalert@redhat.com

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us

Source: secalert@redhat.com

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us

Source: secalert@redhat.com

Third Party Advisory

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

Source: secalert@redhat.com

Third Party Advisory

https://www.openssl.org/news/secadv/20160922.txt

Source: secalert@redhat.com

Vendor Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.tenable.com/security/tns-2016-16

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-20

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-21

Source: secalert@redhat.com

Third Party Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759