fkie_cve-2016-2176
Vulnerability from fkie_nvd
Published
2016-05-05 01:59
Modified
2025-04-12 10:46
Severity ?
Summary
The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", matchCriteriaId: "C1F608A0-78BE-4F17-9E41-70933E52B3C7", versionEndIncluding: "1.0.1s", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*", matchCriteriaId: "AD3E5C1B-EC63-4214-A0BD-0B8681CE6C8B", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*", matchCriteriaId: "18797BEE-417D-4959-9AAD-C5A7C051B524", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*", matchCriteriaId: "6FAA3C31-BD9D-45A9-A502-837FECA6D479", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*", matchCriteriaId: "6455A421-9956-4846-AC7C-3431E0D37D23", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*", matchCriteriaId: "60F946FD-F564-49DA-B043-5943308BA9EE", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*", matchCriteriaId: "4847BCF3-EFCE-41AF-8E7D-3D51EB9DCC5B", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*", matchCriteriaId: "9B89180B-FB68-4DD8-B076-16E51CC7FB91", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*", matchCriteriaId: "4C986592-4086-4A39-9767-EF34DBAA6A53", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*", matchCriteriaId: "7B23181C-03DB-4E92-B3F6-6B585B5231B4", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*", matchCriteriaId: "94D9EC1C-4843-4026-9B05-E060E9391734", vulnerable: true, }, { criteria: "cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*", matchCriteriaId: "B066401C-21CF-4BE9-9C55-C9F1E0C7BE3F", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.", }, { lang: "es", value: "La función X509_NAME_oneline en crypto/x509/x509_obj.c en OpenSSL en versiones anteriores a 1.0.1t y 1.0.2 en versiones anteriores a 1.0.2h permite a atacantes remotos obtener información sensible de la pila de memoria de proceso o provocar una denegación de servicio (sobrelectura de buffer) a través de datos EBCDIC ASN.1 manipulados.", }, ], id: "CVE-2016-2176", lastModified: "2025-04-12T10:46:40.837", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.4, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 4.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.2, baseSeverity: "HIGH", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", version: "3.0", }, exploitabilityScore: 3.9, impactScore: 4.2, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2016-05-05T01:59:06.340", references: [ { source: "secalert@redhat.com", url: "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html", }, { source: "secalert@redhat.com", url: "http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html", }, { source: "secalert@redhat.com", url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl", }, { source: "secalert@redhat.com", url: "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html", }, { source: "secalert@redhat.com", url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", }, { source: "secalert@redhat.com", url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html", }, { source: "secalert@redhat.com", url: "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html", }, { source: "secalert@redhat.com", url: "http://www.securityfocus.com/bid/89746", }, { source: "secalert@redhat.com", url: "http://www.securityfocus.com/bid/91787", }, { source: "secalert@redhat.com", url: "http://www.securitytracker.com/id/1035721", }, { source: "secalert@redhat.com", url: "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103", }, { source: "secalert@redhat.com", url: "https://bto.bluecoat.com/security-advisory/sa123", }, { source: "secalert@redhat.com", url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, { source: "secalert@redhat.com", url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2919516136a4227d9e6d8f2fe66ef976aaf8c561", }, { source: "secalert@redhat.com", url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us", }, { source: "secalert@redhat.com", url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us", }, { source: "secalert@redhat.com", url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202", }, { source: "secalert@redhat.com", url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10160", }, { source: "secalert@redhat.com", url: "https://security.gentoo.org/glsa/201612-16", }, { source: "secalert@redhat.com", url: "https://security.netapp.com/advisory/ntap-20160504-0001/", }, { source: "secalert@redhat.com", url: "https://support.apple.com/HT206903", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://www.openssl.org/news/secadv/20160503.txt", }, { source: "secalert@redhat.com", url: "https://www.tenable.com/security/tns-2016-18", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/89746", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/91787", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securitytracker.com/id/1035721", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://bto.bluecoat.com/security-advisory/sa123", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2919516136a4227d9e6d8f2fe66ef976aaf8c561", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10160", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://security.gentoo.org/glsa/201612-16", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://security.netapp.com/advisory/ntap-20160504-0001/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://support.apple.com/HT206903", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.openssl.org/news/secadv/20160503.txt", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.tenable.com/security/tns-2016-18", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Deferred", weaknesses: [ { description: [ { lang: "en", value: "CWE-119", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.