CVE-2016-6309

Published: Sep 26, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.

Affected (1)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.1.0a

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (28)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/93177

Source: secalert@redhat.com

http://www.securitytracker.com/id/1036885

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa132

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=acacbfa7565c78d2273c0b2a2e5e803f44afefeb

Source: secalert@redhat.com

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us

Source: secalert@redhat.com

https://www.openssl.org/news/secadv/20160926.txt

Source: secalert@redhat.com

Vendor Advisory

https://www.tenable.com/security/tns-2016-16

Source: secalert@redhat.com

https://www.tenable.com/security/tns-2016-20

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759