csaf_suse - suse-su-2016:2468-1

Vulnerability from csaf_suse

Published

2016-10-06 14:46

Modified

2016-10-06 14:46

Summary

Security update for compat-openssl098

Notes

Title of the patch

Security update for compat-openssl098

Description of the patch

This update for compat-openssl098 fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed: * update expired S/MIME certs (bsc#979475) * fix crash in print_notice (bsc#998190) * resume reading from /dev/urandom when interrupted by a signal (bsc#995075)

Patchnames

SUSE-SLE-DESKTOP-12-SP1-2016-1441,SUSE-SLE-Module-Legacy-12-2016-1441,SUSE-SLE-SAP-12-SP1-2016-1441

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for compat-openssl098",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "\nThis update for compat-openssl098 fixes the following issues:\n\nOpenSSL Security Advisory [22 Sep 2016] (bsc#999665)\n\nSeverity: High\n* OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666)\n\nSeverity: Low\n* Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575)\n* Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)\n* DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)\n* DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)\n* OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)\n* Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359)\n* Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)\n* OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)\n* Certificate message OOB reads (CVE-2016-6306) (bsc#999668)\n\nMore information can be found on: https://www.openssl.org/news/secadv/20160922.txt\n\nBugs fixed:\n* update expired S/MIME certs (bsc#979475)\n* fix crash in print_notice (bsc#998190)\n* resume reading from /dev/urandom when interrupted by a signal (bsc#995075)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-SLE-DESKTOP-12-SP1-2016-1441,SUSE-SLE-Module-Legacy-12-2016-1441,SUSE-SLE-SAP-12-SP1-2016-1441",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_2468-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2016:2468-1",
            url: "https://www.suse.com/support/update/announcement/2016/suse-su-20162468-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2016:2468-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2016-October/002313.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 979475",
            url: "https://bugzilla.suse.com/979475",
         },
         {
            category: "self",
            summary: "SUSE Bug 982575",
            url: "https://bugzilla.suse.com/982575",
         },
         {
            category: "self",
            summary: "SUSE Bug 983249",
            url: "https://bugzilla.suse.com/983249",
         },
         {
            category: "self",
            summary: "SUSE Bug 993819",
            url: "https://bugzilla.suse.com/993819",
         },
         {
            category: "self",
            summary: "SUSE Bug 994749",
            url: "https://bugzilla.suse.com/994749",
         },
         {
            category: "self",
            summary: "SUSE Bug 994844",
            url: "https://bugzilla.suse.com/994844",
         },
         {
            category: "self",
            summary: "SUSE Bug 995075",
            url: "https://bugzilla.suse.com/995075",
         },
         {
            category: "self",
            summary: "SUSE Bug 995324",
            url: "https://bugzilla.suse.com/995324",
         },
         {
            category: "self",
            summary: "SUSE Bug 995359",
            url: "https://bugzilla.suse.com/995359",
         },
         {
            category: "self",
            summary: "SUSE Bug 995377",
            url: "https://bugzilla.suse.com/995377",
         },
         {
            category: "self",
            summary: "SUSE Bug 998190",
            url: "https://bugzilla.suse.com/998190",
         },
         {
            category: "self",
            summary: "SUSE Bug 999665",
            url: "https://bugzilla.suse.com/999665",
         },
         {
            category: "self",
            summary: "SUSE Bug 999666",
            url: "https://bugzilla.suse.com/999666",
         },
         {
            category: "self",
            summary: "SUSE Bug 999668",
            url: "https://bugzilla.suse.com/999668",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-2177 page",
            url: "https://www.suse.com/security/cve/CVE-2016-2177/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-2178 page",
            url: "https://www.suse.com/security/cve/CVE-2016-2178/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-2179 page",
            url: "https://www.suse.com/security/cve/CVE-2016-2179/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-2181 page",
            url: "https://www.suse.com/security/cve/CVE-2016-2181/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-2182 page",
            url: "https://www.suse.com/security/cve/CVE-2016-2182/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-2183 page",
            url: "https://www.suse.com/security/cve/CVE-2016-2183/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-6302 page",
            url: "https://www.suse.com/security/cve/CVE-2016-6302/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-6303 page",
            url: "https://www.suse.com/security/cve/CVE-2016-6303/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-6304 page",
            url: "https://www.suse.com/security/cve/CVE-2016-6304/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-6306 page",
            url: "https://www.suse.com/security/cve/CVE-2016-6306/",
         },
      ],
      title: "Security update for compat-openssl098",
      tracking: {
         current_release_date: "2016-10-06T14:46:15Z",
         generator: {
            date: "2016-10-06T14:46:15Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2016:2468-1",
         initial_release_date: "2016-10-06T14:46:15Z",
         revision_history: [
            {
               date: "2016-10-06T14:46:15Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libopenssl0_9_8-0.9.8j-102.1.s390x",
                        product: {
                           name: "libopenssl0_9_8-0.9.8j-102.1.s390x",
                           product_id: "libopenssl0_9_8-0.9.8j-102.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                        product: {
                           name: "libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                           product_id: "libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libopenssl0_9_8-0.9.8j-102.1.x86_64",
                        product: {
                           name: "libopenssl0_9_8-0.9.8j-102.1.x86_64",
                           product_id: "libopenssl0_9_8-0.9.8j-102.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                        product: {
                           name: "libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                           product_id: "libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Desktop 12 SP1",
                        product: {
                           name: "SUSE Linux Enterprise Desktop 12 SP1",
                           product_id: "SUSE Linux Enterprise Desktop 12 SP1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sled:12:sp1",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Legacy 12",
                        product: {
                           name: "SUSE Linux Enterprise Module for Legacy 12",
                           product_id: "SUSE Linux Enterprise Module for Legacy 12",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-legacy:12",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:12:sp1",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl0_9_8-0.9.8j-102.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1",
               product_id: "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            },
            product_reference: "libopenssl0_9_8-0.9.8j-102.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Desktop 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1",
               product_id: "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
            },
            product_reference: "libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Desktop 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl0_9_8-0.9.8j-102.1.s390x as component of SUSE Linux Enterprise Module for Legacy 12",
               product_id: "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
            },
            product_reference: "libopenssl0_9_8-0.9.8j-102.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Legacy 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl0_9_8-0.9.8j-102.1.x86_64 as component of SUSE Linux Enterprise Module for Legacy 12",
               product_id: "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            },
            product_reference: "libopenssl0_9_8-0.9.8j-102.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Legacy 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl0_9_8-32bit-0.9.8j-102.1.s390x as component of SUSE Linux Enterprise Module for Legacy 12",
               product_id: "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
            },
            product_reference: "libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Legacy 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64 as component of SUSE Linux Enterprise Module for Legacy 12",
               product_id: "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
            },
            product_reference: "libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Legacy 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl0_9_8-0.9.8j-102.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            },
            product_reference: "libopenssl0_9_8-0.9.8j-102.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2016-2177",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-2177",
            },
         ],
         notes: [
            {
               category: "general",
               text: "OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-2177",
               url: "https://www.suse.com/security/cve/CVE-2016-2177",
            },
            {
               category: "external",
               summary: "SUSE Bug 982575 for CVE-2016-2177",
               url: "https://bugzilla.suse.com/982575",
            },
            {
               category: "external",
               summary: "SUSE Bug 999075 for CVE-2016-2177",
               url: "https://bugzilla.suse.com/999075",
            },
            {
               category: "external",
               summary: "SUSE Bug 999665 for CVE-2016-2177",
               url: "https://bugzilla.suse.com/999665",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "important",
            },
         ],
         title: "CVE-2016-2177",
      },
      {
         cve: "CVE-2016-2178",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-2178",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-2178",
               url: "https://www.suse.com/security/cve/CVE-2016-2178",
            },
            {
               category: "external",
               summary: "SUSE Bug 1004104 for CVE-2016-2178",
               url: "https://bugzilla.suse.com/1004104",
            },
            {
               category: "external",
               summary: "SUSE Bug 983249 for CVE-2016-2178",
               url: "https://bugzilla.suse.com/983249",
            },
            {
               category: "external",
               summary: "SUSE Bug 983519 for CVE-2016-2178",
               url: "https://bugzilla.suse.com/983519",
            },
            {
               category: "external",
               summary: "SUSE Bug 999665 for CVE-2016-2178",
               url: "https://bugzilla.suse.com/999665",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "low",
            },
         ],
         title: "CVE-2016-2178",
      },
      {
         cve: "CVE-2016-2179",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-2179",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-2179",
               url: "https://www.suse.com/security/cve/CVE-2016-2179",
            },
            {
               category: "external",
               summary: "SUSE Bug 1004104 for CVE-2016-2179",
               url: "https://bugzilla.suse.com/1004104",
            },
            {
               category: "external",
               summary: "SUSE Bug 994844 for CVE-2016-2179",
               url: "https://bugzilla.suse.com/994844",
            },
            {
               category: "external",
               summary: "SUSE Bug 999665 for CVE-2016-2179",
               url: "https://bugzilla.suse.com/999665",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "moderate",
            },
         ],
         title: "CVE-2016-2179",
      },
      {
         cve: "CVE-2016-2181",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-2181",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-2181",
               url: "https://www.suse.com/security/cve/CVE-2016-2181",
            },
            {
               category: "external",
               summary: "SUSE Bug 1004104 for CVE-2016-2181",
               url: "https://bugzilla.suse.com/1004104",
            },
            {
               category: "external",
               summary: "SUSE Bug 994749 for CVE-2016-2181",
               url: "https://bugzilla.suse.com/994749",
            },
            {
               category: "external",
               summary: "SUSE Bug 994844 for CVE-2016-2181",
               url: "https://bugzilla.suse.com/994844",
            },
            {
               category: "external",
               summary: "SUSE Bug 999665 for CVE-2016-2181",
               url: "https://bugzilla.suse.com/999665",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "low",
            },
         ],
         title: "CVE-2016-2181",
      },
      {
         cve: "CVE-2016-2182",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-2182",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-2182",
               url: "https://www.suse.com/security/cve/CVE-2016-2182",
            },
            {
               category: "external",
               summary: "SUSE Bug 1004104 for CVE-2016-2182",
               url: "https://bugzilla.suse.com/1004104",
            },
            {
               category: "external",
               summary: "SUSE Bug 993819 for CVE-2016-2182",
               url: "https://bugzilla.suse.com/993819",
            },
            {
               category: "external",
               summary: "SUSE Bug 994844 for CVE-2016-2182",
               url: "https://bugzilla.suse.com/994844",
            },
            {
               category: "external",
               summary: "SUSE Bug 995959 for CVE-2016-2182",
               url: "https://bugzilla.suse.com/995959",
            },
            {
               category: "external",
               summary: "SUSE Bug 999665 for CVE-2016-2182",
               url: "https://bugzilla.suse.com/999665",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "low",
            },
         ],
         title: "CVE-2016-2182",
      },
      {
         cve: "CVE-2016-2183",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-2183",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-2183",
               url: "https://www.suse.com/security/cve/CVE-2016-2183",
            },
            {
               category: "external",
               summary: "SUSE Bug 1001912 for CVE-2016-2183",
               url: "https://bugzilla.suse.com/1001912",
            },
            {
               category: "external",
               summary: "SUSE Bug 1024218 for CVE-2016-2183",
               url: "https://bugzilla.suse.com/1024218",
            },
            {
               category: "external",
               summary: "SUSE Bug 1027038 for CVE-2016-2183",
               url: "https://bugzilla.suse.com/1027038",
            },
            {
               category: "external",
               summary: "SUSE Bug 1034689 for CVE-2016-2183",
               url: "https://bugzilla.suse.com/1034689",
            },
            {
               category: "external",
               summary: "SUSE Bug 1056614 for CVE-2016-2183",
               url: "https://bugzilla.suse.com/1056614",
            },
            {
               category: "external",
               summary: "SUSE Bug 1171693 for CVE-2016-2183",
               url: "https://bugzilla.suse.com/1171693",
            },
            {
               category: "external",
               summary: "SUSE Bug 994844 for CVE-2016-2183",
               url: "https://bugzilla.suse.com/994844",
            },
            {
               category: "external",
               summary: "SUSE Bug 995359 for CVE-2016-2183",
               url: "https://bugzilla.suse.com/995359",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "moderate",
            },
         ],
         title: "CVE-2016-2183",
      },
      {
         cve: "CVE-2016-6302",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-6302",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-6302",
               url: "https://www.suse.com/security/cve/CVE-2016-6302",
            },
            {
               category: "external",
               summary: "SUSE Bug 1004104 for CVE-2016-6302",
               url: "https://bugzilla.suse.com/1004104",
            },
            {
               category: "external",
               summary: "SUSE Bug 994844 for CVE-2016-6302",
               url: "https://bugzilla.suse.com/994844",
            },
            {
               category: "external",
               summary: "SUSE Bug 995324 for CVE-2016-6302",
               url: "https://bugzilla.suse.com/995324",
            },
            {
               category: "external",
               summary: "SUSE Bug 999665 for CVE-2016-6302",
               url: "https://bugzilla.suse.com/999665",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "moderate",
            },
         ],
         title: "CVE-2016-6302",
      },
      {
         cve: "CVE-2016-6303",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-6303",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-6303",
               url: "https://www.suse.com/security/cve/CVE-2016-6303",
            },
            {
               category: "external",
               summary: "SUSE Bug 1004104 for CVE-2016-6303",
               url: "https://bugzilla.suse.com/1004104",
            },
            {
               category: "external",
               summary: "SUSE Bug 1115893 for CVE-2016-6303",
               url: "https://bugzilla.suse.com/1115893",
            },
            {
               category: "external",
               summary: "SUSE Bug 994844 for CVE-2016-6303",
               url: "https://bugzilla.suse.com/994844",
            },
            {
               category: "external",
               summary: "SUSE Bug 995377 for CVE-2016-6303",
               url: "https://bugzilla.suse.com/995377",
            },
            {
               category: "external",
               summary: "SUSE Bug 999665 for CVE-2016-6303",
               url: "https://bugzilla.suse.com/999665",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "low",
            },
         ],
         title: "CVE-2016-6303",
      },
      {
         cve: "CVE-2016-6304",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-6304",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-6304",
               url: "https://www.suse.com/security/cve/CVE-2016-6304",
            },
            {
               category: "external",
               summary: "SUSE Bug 1001706 for CVE-2016-6304",
               url: "https://bugzilla.suse.com/1001706",
            },
            {
               category: "external",
               summary: "SUSE Bug 1003811 for CVE-2016-6304",
               url: "https://bugzilla.suse.com/1003811",
            },
            {
               category: "external",
               summary: "SUSE Bug 1004104 for CVE-2016-6304",
               url: "https://bugzilla.suse.com/1004104",
            },
            {
               category: "external",
               summary: "SUSE Bug 1005579 for CVE-2016-6304",
               url: "https://bugzilla.suse.com/1005579",
            },
            {
               category: "external",
               summary: "SUSE Bug 1021375 for CVE-2016-6304",
               url: "https://bugzilla.suse.com/1021375",
            },
            {
               category: "external",
               summary: "SUSE Bug 999665 for CVE-2016-6304",
               url: "https://bugzilla.suse.com/999665",
            },
            {
               category: "external",
               summary: "SUSE Bug 999666 for CVE-2016-6304",
               url: "https://bugzilla.suse.com/999666",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "moderate",
            },
         ],
         title: "CVE-2016-6304",
      },
      {
         cve: "CVE-2016-6306",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-6306",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
               "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-6306",
               url: "https://www.suse.com/security/cve/CVE-2016-6306",
            },
            {
               category: "external",
               summary: "SUSE Bug 1004104 for CVE-2016-6306",
               url: "https://bugzilla.suse.com/1004104",
            },
            {
               category: "external",
               summary: "SUSE Bug 999665 for CVE-2016-6306",
               url: "https://bugzilla.suse.com/999665",
            },
            {
               category: "external",
               summary: "SUSE Bug 999668 for CVE-2016-6306",
               url: "https://bugzilla.suse.com/999668",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.s390x",
                  "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-102.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-102.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2016-10-06T14:46:15Z",
               details: "low",
            },
         ],
         title: "CVE-2016-6306",
      },
   ],
}

cve-2016-6303

Vulnerability from cvelistv5

Published

2016-09-16 00:00

Modified

2024-08-06 01:29

Severity ?

Summary

Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

References

▼	URL	Tags
	https://www.tenable.com/security/tns-2016-20
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	http://www.securitytracker.com/id/1036885	vdb-entry
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
	https://www.tenable.com/security/tns-2016-16
	https://www.tenable.com/security/tns-2016-21
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	http://www.securityfocus.com/bid/92984	vdb-entry
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	https://bugzilla.redhat.com/show_bug.cgi?id=1370146
	https://bto.bluecoat.com/security-advisory/sa132
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	vendor-advisory
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=55d83bf7c10c7b205fffa23fa7c3977491e56c07
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T01:29:18.225Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  name: "1036885",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036885",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  name: "92984",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/92984",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1370146",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa132",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "FreeBSD-SA-16:26",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=55d83bf7c10c7b205fffa23fa7c3977491e56c07",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-08-24T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               name: "1036885",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036885",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               name: "92984",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/92984",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1370146",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa132",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "FreeBSD-SA-16:26",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=55d83bf7c10c7b205fffa23fa7c3977491e56c07",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-6303",
      datePublished: "2016-09-16T00:00:00",
      dateReserved: "2016-07-26T00:00:00",
      dateUpdated: "2024-08-06T01:29:18.225Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-2183

Vulnerability from cvelistv5

Published

2016-09-01 00:00

Modified

2025-03-31 14:15

Severity ?

Summary

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2017:3113	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2017-0338.html	vendor-advisory
	https://www.tenable.com/security/tns-2016-20
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us
	https://security.gentoo.org/glsa/201612-16	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415
	https://access.redhat.com/errata/RHSA-2017:3240	vendor-advisory
	https://www.tenable.com/security/tns-2016-16
	https://access.redhat.com/errata/RHSA-2017:2709	vendor-advisory
	http://www.securityfocus.com/bid/92630	vdb-entry
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499
	https://www.tenable.com/security/tns-2016-21
	https://kc.mcafee.com/corporate/index?page=content&id=SB10171
	https://access.redhat.com/errata/RHSA-2017:3239	vendor-advisory
	https://www.exploit-db.com/exploits/42091/	exploit
	https://security.gentoo.org/glsa/201701-65	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
	http://www.securitytracker.com/id/1036696	vdb-entry
	https://security.netapp.com/advisory/ntap-20160915-0001/
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us
	https://security.gentoo.org/glsa/201707-01	vendor-advisory
	http://www.securityfocus.com/bid/95568	vdb-entry
	https://access.redhat.com/errata/RHSA-2017:3114	vendor-advisory
	https://bto.bluecoat.com/security-advisory/sa133
	https://www.tenable.com/security/tns-2017-09
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116
	https://access.redhat.com/errata/RHSA-2017:1216	vendor-advisory
	https://wiki.opendaylight.org/view/Security_Advisories
	https://access.redhat.com/errata/RHSA-2017:2710	vendor-advisory
	https://security.netapp.com/advisory/ntap-20170119-0001/
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984
	https://www.ietf.org/mail-archive/web/tls/current/msg04560.html	mailing-list
	https://access.redhat.com/errata/RHSA-2018:2123	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2017-0337.html	vendor-advisory
	https://access.redhat.com/errata/RHSA-2017:2708	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2017-0336.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
	http://rhn.redhat.com/errata/RHSA-2017-0462.html	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	https://kc.mcafee.com/corporate/index?page=content&id=SB10215
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	vendor-advisory
	http://www.securityfocus.com/archive/1/540341/100/0/threaded	mailing-list
	http://www.ubuntu.com/usn/USN-3087-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05385680
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	vendor-advisory
	http://www.securityfocus.com/archive/1/archive/1/539885/100/0/threaded	mailing-list
	http://www.ubuntu.com/usn/USN-3087-2	vendor-advisory
	http://www.securityfocus.com/archive/1/archive/1/542005/100/0/threaded	mailing-list
	https://kc.mcafee.com/corporate/index?page=content&id=SB10197
	https://kc.mcafee.com/corporate/index?page=content&id=SB10186
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	vendor-advisory
	http://www.securityfocus.com/archive/1/archive/1/541104/100/0/threaded	mailing-list
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390849
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	vendor-advisory
	https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158613
	http://seclists.org/fulldisclosure/2017/Jul/31	mailing-list
	http://www.ubuntu.com/usn/USN-3194-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	vendor-advisory
	https://seclists.org/bugtraq/2018/Nov/21	mailing-list
	https://support.f5.com/csp/article/K13167034
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390722
	http://www.securityfocus.com/archive/1/542005/100/0/threaded	mailing-list
	http://www.debian.org/security/2016/dsa-3673	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3372-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00023.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00028.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3270-1	vendor-advisory
	http://www.securityfocus.com/archive/1/archive/1/540129/100/0/threaded	mailing-list
	https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286178
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	vendor-advisory
	http://seclists.org/fulldisclosure/2017/May/105	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00032.html	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448
	http://www.securityfocus.com/archive/1/539885/100/0/threaded	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00003.html	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369415
	http://packetstormsecurity.com/files/142756/IBM-Informix-Dynamic-Server-DLL-Injection-Code-Execution.html
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3198-1	vendor-advisory
	http://seclists.org/fulldisclosure/2017/May/105
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369403
	http://www.securityfocus.com/archive/1/541104/100/0/threaded	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00076.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	vendor-advisory
	http://www.securityfocus.com/archive/1/archive/1/540341/100/0/threaded	mailing-list
	http://www.ubuntu.com/usn/USN-3179-1	vendor-advisory
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en
	https://access.redhat.com/errata/RHSA-2019:1245	vendor-advisory
	https://access.redhat.com/errata/RHSA-2019:2859	vendor-advisory
	https://access.redhat.com/errata/RHSA-2020:0451	vendor-advisory
	https://kc.mcafee.com/corporate/index?page=content&id=SB10310
	https://www.oracle.com/security-alerts/cpuapr2020.html
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	https://www.oracle.com/security-alerts/cpujul2020.html
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
	https://www.oracle.com/security-alerts/cpujan2020.html
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	https://sweet32.info/
	http://www.splunk.com/view/SP-CAAAPUE
	https://bugzilla.redhat.com/show_bug.cgi?id=1369383
	https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
	https://access.redhat.com/articles/2548661
	https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue
	http://www.splunk.com/view/SP-CAAAPSV
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633
	https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
	https://www.sigsac.org/ccs/CCS2016/accepted-papers/
	http://www-01.ibm.com/support/docview.wss?uid=swg21991482
	https://www.openssl.org/blog/blog/2016/08/24/sweet32/
	https://access.redhat.com/security/cve/cve-2016-2183
	https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/
	https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
	https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/
	https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008
	http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697
	https://www.oracle.com/security-alerts/cpuoct2020.html
	https://www.oracle.com/security-alerts/cpuoct2021.html
	https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2025-03-31T14:15:56.806Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://www.vicarius.io/vsociety/posts/cve-2016-2183-detection-sweet32-vulnerability",
               },
               {
                  url: "https://www.vicarius.io/vsociety/posts/cve-2016-2183-mitigate-sweet32-vulnerability",
               },
               {
                  name: "RHSA-2017:3113",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3113",
               },
               {
                  name: "RHSA-2017:0338",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-0338.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us",
               },
               {
                  name: "GLSA-201612-16",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201612-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415",
               },
               {
                  name: "RHSA-2017:3240",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3240",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  name: "RHSA-2017:2709",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2709",
               },
               {
                  name: "92630",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/92630",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10171",
               },
               {
                  name: "RHSA-2017:3239",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3239",
               },
               {
                  name: "42091",
                  tags: [
                     "exploit",
                     "x_transferred",
                  ],
                  url: "https://www.exploit-db.com/exploits/42091/",
               },
               {
                  name: "GLSA-201701-65",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201701-65",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
               },
               {
                  name: "1036696",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036696",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20160915-0001/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us",
               },
               {
                  name: "GLSA-201707-01",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201707-01",
               },
               {
                  name: "95568",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/95568",
               },
               {
                  name: "RHSA-2017:3114",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3114",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa133",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2017-09",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116",
               },
               {
                  name: "RHSA-2017:1216",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1216",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://wiki.opendaylight.org/view/Security_Advisories",
               },
               {
                  name: "RHSA-2017:2710",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2710",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20170119-0001/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984",
               },
               {
                  name: "[tls] 20091120 RC4+3DES rekeying - long-lived TLS connections",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://www.ietf.org/mail-archive/web/tls/current/msg04560.html",
               },
               {
                  name: "RHSA-2018:2123",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2123",
               },
               {
                  name: "RHSA-2017:0337",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-0337.html",
               },
               {
                  name: "RHSA-2017:2708",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2708",
               },
               {
                  name: "RHSA-2017:0336",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-0336.html",
               },
               {
                  name: "SUSE-SU-2016:2470",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
               },
               {
                  name: "RHSA-2017:0462",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-0462.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
               },
               {
                  name: "SUSE-SU-2017:2700",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
               },
               {
                  name: "20170329 [security bulletin] HPESBUX03725 rev.1 - HPE HP-UX Web Server Suite running Apache, Multiple Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/540341/100/0/threaded",
               },
               {
                  name: "USN-3087-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-1",
               },
               {
                  name: "SUSE-SU-2016:2469",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05385680",
               },
               {
                  name: "openSUSE-SU-2016:2537",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
               },
               {
                  name: "20161207 [security bulletin] HPSBHF03674 rev.1 HPE Comware 5 and Comware 7 Network Products using SSL/TLS, Remote Disclosure of Information",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/archive/1/539885/100/0/threaded",
               },
               {
                  name: "USN-3087-2",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-2",
               },
               {
                  name: "20180510 [security bulletin] MFSBGN03805 - HP Service Manager, Remote Disclosure of Information",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/archive/1/542005/100/0/threaded",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10197",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10186",
               },
               {
                  name: "SUSE-SU-2017:2699",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
               },
               {
                  name: "20170831 [security bulletin] HPESBGN03765 rev.2 - HPE LoadRunner and HPE Performance Center, Remote Disclosure of Information",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/archive/1/541104/100/0/threaded",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390849",
               },
               {
                  name: "openSUSE-SU-2016:2407",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158613",
               },
               {
                  name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2017/Jul/31",
               },
               {
                  name: "USN-3194-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3194-1",
               },
               {
                  name: "SUSE-SU-2016:2458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
               },
               {
                  name: "20181113 [security bulletin] MFSBGN03831 rev. - Service Management Automation, remote disclosure of information",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2018/Nov/21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.f5.com/csp/article/K13167034",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390722",
               },
               {
                  name: "20180510 [security bulletin] MFSBGN03805 - HP Service Manager, Remote Disclosure of Information",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/542005/100/0/threaded",
               },
               {
                  name: "DSA-3673",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2016/dsa-3673",
               },
               {
                  name: "openSUSE-SU-2016:2391",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
               },
               {
                  name: "USN-3372-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3372-1",
               },
               {
                  name: "openSUSE-SU-2018:0458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
               },
               {
                  name: "SUSE-SU-2017:0460",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00023.html",
               },
               {
                  name: "SUSE-SU-2017:0490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00028.html",
               },
               {
                  name: "USN-3270-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3270-1",
               },
               {
                  name: "20170214 [security bulletin] HPESBGN03697 rev.1 - HPE Business Service Management (BSM), Remote Disclosure of Information",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/archive/1/540129/100/0/threaded",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286178",
               },
               {
                  name: "SUSE-SU-2016:2387",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
               },
               {
                  name: "20170529 SSD Advisory - IBM Informix Dynamic Server and Informix Open Admin Tool Multiple Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2017/May/105",
               },
               {
                  name: "openSUSE-SU-2017:0513",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00032.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
               },
               {
                  name: "20161207 [security bulletin] HPSBHF03674 rev.1 HPE Comware 5 and Comware 7 Network Products using SSL/TLS, Remote Disclosure of Information",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/539885/100/0/threaded",
               },
               {
                  name: "openSUSE-SU-2017:0374",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00003.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369415",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/142756/IBM-Informix-Dynamic-Server-DLL-Injection-Code-Execution.html",
               },
               {
                  name: "SUSE-SU-2016:2468",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
               },
               {
                  name: "SUSE-SU-2017:0346",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2016:2496",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html",
               },
               {
                  name: "USN-3198-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3198-1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2017/May/105",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369403",
               },
               {
                  name: "20170831 [security bulletin] HPESBGN03765 rev.2 - HPE LoadRunner and HPE Performance Center, Remote Disclosure of Information",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/541104/100/0/threaded",
               },
               {
                  name: "SUSE-SU-2017:1444",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00076.html",
               },
               {
                  name: "SUSE-SU-2016:2394",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
               },
               {
                  name: "20170329 [security bulletin] HPESBUX03725 rev.1 - HPE HP-UX Web Server Suite running Apache, Multiple Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/archive/1/540341/100/0/threaded",
               },
               {
                  name: "USN-3179-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3179-1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
               },
               {
                  name: "RHSA-2019:1245",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:1245",
               },
               {
                  name: "RHSA-2019:2859",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:2859",
               },
               {
                  name: "RHSA-2020:0451",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0451",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10310",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://sweet32.info/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPUE",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1369383",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/articles/2548661",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPSV",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.sigsac.org/ccs/CCS2016/accepted-papers/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21991482",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.openssl.org/blog/blog/2016/08/24/sweet32/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/cve-2016-2183",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
            x_generator: {
               engine: "ADPogram 0.0.1",
            },
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-08-24T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00.000Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2017:3113",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3113",
            },
            {
               name: "RHSA-2017:0338",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-0338.html",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us",
            },
            {
               name: "GLSA-201612-16",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/201612-16",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415",
            },
            {
               name: "RHSA-2017:3240",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3240",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               name: "RHSA-2017:2709",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2709",
            },
            {
               name: "92630",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/92630",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10171",
            },
            {
               name: "RHSA-2017:3239",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3239",
            },
            {
               name: "42091",
               tags: [
                  "exploit",
               ],
               url: "https://www.exploit-db.com/exploits/42091/",
            },
            {
               name: "GLSA-201701-65",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/201701-65",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
            },
            {
               name: "1036696",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036696",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20160915-0001/",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us",
            },
            {
               name: "GLSA-201707-01",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/201707-01",
            },
            {
               name: "95568",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/95568",
            },
            {
               name: "RHSA-2017:3114",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3114",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa133",
            },
            {
               url: "https://www.tenable.com/security/tns-2017-09",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116",
            },
            {
               name: "RHSA-2017:1216",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1216",
            },
            {
               url: "https://wiki.opendaylight.org/view/Security_Advisories",
            },
            {
               name: "RHSA-2017:2710",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2710",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20170119-0001/",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984",
            },
            {
               name: "[tls] 20091120 RC4+3DES rekeying - long-lived TLS connections",
               tags: [
                  "mailing-list",
               ],
               url: "https://www.ietf.org/mail-archive/web/tls/current/msg04560.html",
            },
            {
               name: "RHSA-2018:2123",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2123",
            },
            {
               name: "RHSA-2017:0337",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-0337.html",
            },
            {
               name: "RHSA-2017:2708",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2708",
            },
            {
               name: "RHSA-2017:0336",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-0336.html",
            },
            {
               name: "SUSE-SU-2016:2470",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
            },
            {
               name: "RHSA-2017:0462",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-0462.html",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
            },
            {
               name: "SUSE-SU-2017:2700",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
            },
            {
               name: "20170329 [security bulletin] HPESBUX03725 rev.1 - HPE HP-UX Web Server Suite running Apache, Multiple Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/540341/100/0/threaded",
            },
            {
               name: "USN-3087-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-1",
            },
            {
               name: "SUSE-SU-2016:2469",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05385680",
            },
            {
               name: "openSUSE-SU-2016:2537",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
            },
            {
               name: "20161207 [security bulletin] HPSBHF03674 rev.1 HPE Comware 5 and Comware 7 Network Products using SSL/TLS, Remote Disclosure of Information",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/archive/1/539885/100/0/threaded",
            },
            {
               name: "USN-3087-2",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-2",
            },
            {
               name: "20180510 [security bulletin] MFSBGN03805 - HP Service Manager, Remote Disclosure of Information",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/archive/1/542005/100/0/threaded",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10197",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10186",
            },
            {
               name: "SUSE-SU-2017:2699",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
            },
            {
               name: "20170831 [security bulletin] HPESBGN03765 rev.2 - HPE LoadRunner and HPE Performance Center, Remote Disclosure of Information",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/archive/1/541104/100/0/threaded",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390849",
            },
            {
               name: "openSUSE-SU-2016:2407",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
            },
            {
               url: "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158613",
            },
            {
               name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2017/Jul/31",
            },
            {
               name: "USN-3194-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3194-1",
            },
            {
               name: "SUSE-SU-2016:2458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
            },
            {
               name: "20181113 [security bulletin] MFSBGN03831 rev. - Service Management Automation, remote disclosure of information",
               tags: [
                  "mailing-list",
               ],
               url: "https://seclists.org/bugtraq/2018/Nov/21",
            },
            {
               url: "https://support.f5.com/csp/article/K13167034",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390722",
            },
            {
               name: "20180510 [security bulletin] MFSBGN03805 - HP Service Manager, Remote Disclosure of Information",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/542005/100/0/threaded",
            },
            {
               name: "DSA-3673",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.debian.org/security/2016/dsa-3673",
            },
            {
               name: "openSUSE-SU-2016:2391",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
            },
            {
               name: "USN-3372-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3372-1",
            },
            {
               name: "openSUSE-SU-2018:0458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
            },
            {
               name: "SUSE-SU-2017:0460",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00023.html",
            },
            {
               name: "SUSE-SU-2017:0490",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00028.html",
            },
            {
               name: "USN-3270-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3270-1",
            },
            {
               name: "20170214 [security bulletin] HPESBGN03697 rev.1 - HPE Business Service Management (BSM), Remote Disclosure of Information",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/archive/1/540129/100/0/threaded",
            },
            {
               url: "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286178",
            },
            {
               name: "SUSE-SU-2016:2387",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
            },
            {
               name: "20170529 SSD Advisory - IBM Informix Dynamic Server and Informix Open Admin Tool Multiple Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2017/May/105",
            },
            {
               name: "openSUSE-SU-2017:0513",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00032.html",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
            },
            {
               name: "20161207 [security bulletin] HPSBHF03674 rev.1 HPE Comware 5 and Comware 7 Network Products using SSL/TLS, Remote Disclosure of Information",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/539885/100/0/threaded",
            },
            {
               name: "openSUSE-SU-2017:0374",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00003.html",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369415",
            },
            {
               url: "http://packetstormsecurity.com/files/142756/IBM-Informix-Dynamic-Server-DLL-Injection-Code-Execution.html",
            },
            {
               name: "SUSE-SU-2016:2468",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
            },
            {
               name: "SUSE-SU-2017:0346",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html",
            },
            {
               name: "openSUSE-SU-2016:2496",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html",
            },
            {
               name: "USN-3198-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3198-1",
            },
            {
               url: "http://seclists.org/fulldisclosure/2017/May/105",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369403",
            },
            {
               name: "20170831 [security bulletin] HPESBGN03765 rev.2 - HPE LoadRunner and HPE Performance Center, Remote Disclosure of Information",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/541104/100/0/threaded",
            },
            {
               name: "SUSE-SU-2017:1444",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00076.html",
            },
            {
               name: "SUSE-SU-2016:2394",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
            },
            {
               name: "20170329 [security bulletin] HPESBUX03725 rev.1 - HPE HP-UX Web Server Suite running Apache, Multiple Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/archive/1/540341/100/0/threaded",
            },
            {
               name: "USN-3179-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3179-1",
            },
            {
               url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
            },
            {
               name: "RHSA-2019:1245",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:1245",
            },
            {
               name: "RHSA-2019:2859",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:2859",
            },
            {
               name: "RHSA-2020:0451",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0451",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10310",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujan2020.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "https://sweet32.info/",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPUE",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1369383",
            },
            {
               url: "https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
            },
            {
               url: "https://access.redhat.com/articles/2548661",
            },
            {
               url: "https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPSV",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               url: "https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633",
            },
            {
               url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
            },
            {
               url: "https://www.sigsac.org/ccs/CCS2016/accepted-papers/",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21991482",
            },
            {
               url: "https://www.openssl.org/blog/blog/2016/08/24/sweet32/",
            },
            {
               url: "https://access.redhat.com/security/cve/cve-2016-2183",
            },
            {
               url: "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/",
            },
            {
               url: "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
            },
            {
               url: "https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/",
            },
            {
               url: "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-2183",
      datePublished: "2016-09-01T00:00:00.000Z",
      dateReserved: "2016-01-29T00:00:00.000Z",
      dateUpdated: "2025-03-31T14:15:56.806Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-2182

Vulnerability from cvelistv5

Published

2016-09-16 00:00

Modified

2024-08-05 23:17

Severity ?

Summary

The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

References

▼	URL	Tags
	http://www.securitytracker.com/id/1036688	vdb-entry
	https://www.tenable.com/security/tns-2016-20
	https://access.redhat.com/errata/RHSA-2018:2185	vendor-advisory
	https://access.redhat.com/errata/RHSA-2018:2186	vendor-advisory
	http://www.splunk.com/view/SP-CAAAPUE
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	http://www.securityfocus.com/bid/92557	vdb-entry
	https://source.android.com/security/bulletin/2017-03-01
	http://www.securitytracker.com/id/1037968	vdb-entry
	http://rhn.redhat.com/errata/RHSA-2016-1940.html	vendor-advisory
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us
	http://www.splunk.com/view/SP-CAAAPSV
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	https://www.tenable.com/security/tns-2016-16
	https://www.tenable.com/security/tns-2016-21
	https://kc.mcafee.com/corporate/index?page=content&id=SB10171
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
	https://bto.bluecoat.com/security-advisory/sa132
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	vendor-advisory
	https://source.android.com/security/bulletin/2017-03-01.html
	https://access.redhat.com/errata/RHSA-2018:2187	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	https://kc.mcafee.com/corporate/index?page=content&id=SB10215
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-2	vendor-advisory
	https://support.f5.com/csp/article/K01276005
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	vendor-advisory
	http://seclists.org/fulldisclosure/2017/Jul/31	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	vendor-advisory
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us
	http://www.debian.org/security/2016/dsa-3673	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	vendor-advisory
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en
	https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T23:17:50.604Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "1036688",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036688",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  name: "RHSA-2018:2185",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2185",
               },
               {
                  name: "RHSA-2018:2186",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2186",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPUE",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "92557",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/92557",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://source.android.com/security/bulletin/2017-03-01",
               },
               {
                  name: "1037968",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1037968",
               },
               {
                  name: "RHSA-2016:1940",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPSV",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10171",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa132",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "FreeBSD-SA-16:26",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://source.android.com/security/bulletin/2017-03-01.html",
               },
               {
                  name: "RHSA-2018:2187",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2187",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
               },
               {
                  name: "SUSE-SU-2017:2700",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
               },
               {
                  name: "USN-3087-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-1",
               },
               {
                  name: "SUSE-SU-2016:2469",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
               },
               {
                  name: "openSUSE-SU-2016:2537",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
               },
               {
                  name: "USN-3087-2",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-2",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.f5.com/csp/article/K01276005",
               },
               {
                  name: "SUSE-SU-2017:2699",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
               },
               {
                  name: "openSUSE-SU-2016:2407",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
               },
               {
                  name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2017/Jul/31",
               },
               {
                  name: "SUSE-SU-2016:2458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us",
               },
               {
                  name: "DSA-3673",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2016/dsa-3673",
               },
               {
                  name: "openSUSE-SU-2016:2391",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
               },
               {
                  name: "openSUSE-SU-2018:0458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
               },
               {
                  name: "SUSE-SU-2016:2387",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
               },
               {
                  name: "SUSE-SU-2016:2468",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
               },
               {
                  name: "SUSE-SU-2016:2394",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-08-15T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "1036688",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036688",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               name: "RHSA-2018:2185",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2185",
            },
            {
               name: "RHSA-2018:2186",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2186",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPUE",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "92557",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/92557",
            },
            {
               url: "https://source.android.com/security/bulletin/2017-03-01",
            },
            {
               name: "1037968",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1037968",
            },
            {
               name: "RHSA-2016:1940",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPSV",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10171",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa132",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "FreeBSD-SA-16:26",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
            },
            {
               url: "https://source.android.com/security/bulletin/2017-03-01.html",
            },
            {
               name: "RHSA-2018:2187",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2187",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
            },
            {
               name: "SUSE-SU-2017:2700",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
            },
            {
               name: "USN-3087-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-1",
            },
            {
               name: "SUSE-SU-2016:2469",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
            },
            {
               name: "openSUSE-SU-2016:2537",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
            },
            {
               name: "USN-3087-2",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-2",
            },
            {
               url: "https://support.f5.com/csp/article/K01276005",
            },
            {
               name: "SUSE-SU-2017:2699",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
            },
            {
               name: "openSUSE-SU-2016:2407",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
            },
            {
               name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2017/Jul/31",
            },
            {
               name: "SUSE-SU-2016:2458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
            },
            {
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us",
            },
            {
               name: "DSA-3673",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.debian.org/security/2016/dsa-3673",
            },
            {
               name: "openSUSE-SU-2016:2391",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
            },
            {
               name: "openSUSE-SU-2018:0458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
            },
            {
               name: "SUSE-SU-2016:2387",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
            },
            {
               name: "SUSE-SU-2016:2468",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
            },
            {
               name: "SUSE-SU-2016:2394",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
            },
            {
               url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
            },
            {
               url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-2182",
      datePublished: "2016-09-16T00:00:00",
      dateReserved: "2016-01-29T00:00:00",
      dateUpdated: "2024-08-05T23:17:50.604Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-2179

Vulnerability from cvelistv5

Published

2016-09-16 00:00

Modified

2024-08-05 23:17

Severity ?

Summary

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.

References

▼	URL	Tags
	https://www.tenable.com/security/tns-2016-20
	http://www.splunk.com/view/SP-CAAAPUE
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	http://rhn.redhat.com/errata/RHSA-2016-1940.html	vendor-advisory
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us
	http://www.splunk.com/view/SP-CAAAPSV
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	https://www.tenable.com/security/tns-2016-16
	https://www.tenable.com/security/tns-2016-21
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	http://www.securitytracker.com/id/1036689	vdb-entry
	http://www.securityfocus.com/bid/92987	vdb-entry
	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
	https://bto.bluecoat.com/security-advisory/sa132
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	vendor-advisory
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5c7f5dfbaf0d2f7d946d0fe86f08e6bcb36ed0d
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T23:17:50.748Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPUE",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "RHSA-2016:1940",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPSV",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  name: "1036689",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036689",
               },
               {
                  name: "92987",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/92987",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa132",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "FreeBSD-SA-16:26",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5c7f5dfbaf0d2f7d946d0fe86f08e6bcb36ed0d",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-08-22T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPUE",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "RHSA-2016:1940",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPSV",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               name: "1036689",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036689",
            },
            {
               name: "92987",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/92987",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa132",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "FreeBSD-SA-16:26",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5c7f5dfbaf0d2f7d946d0fe86f08e6bcb36ed0d",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-2179",
      datePublished: "2016-09-16T00:00:00",
      dateReserved: "2016-01-29T00:00:00",
      dateUpdated: "2024-08-05T23:17:50.748Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-2181

Vulnerability from cvelistv5

Published

2016-09-16 00:00

Modified

2024-08-05 23:17

Severity ?

Summary

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/92982	vdb-entry
	https://www.tenable.com/security/tns-2016-20
	http://www.splunk.com/view/SP-CAAAPUE
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	http://rhn.redhat.com/errata/RHSA-2016-1940.html	vendor-advisory
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	http://www.splunk.com/view/SP-CAAAPSV
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	https://www.tenable.com/security/tns-2016-16
	https://www.tenable.com/security/tns-2016-21
	http://www.securitytracker.com/id/1036690	vdb-entry
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=1fb9fdc3027b27d8eb6a1e6a846435b070980770
	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
	https://bto.bluecoat.com/security-advisory/sa132
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	vendor-advisory
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	https://kc.mcafee.com/corporate/index?page=content&id=SB10215
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-2	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	vendor-advisory
	http://seclists.org/fulldisclosure/2017/Jul/31	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	vendor-advisory
	https://support.f5.com/csp/article/K59298921
	http://www.debian.org/security/2016/dsa-3673	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	vendor-advisory
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en
	https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T23:17:50.606Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "92982",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/92982",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPUE",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "RHSA-2016:1940",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPSV",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  name: "1036690",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036690",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=1fb9fdc3027b27d8eb6a1e6a846435b070980770",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa132",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "FreeBSD-SA-16:26",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
               },
               {
                  name: "SUSE-SU-2017:2700",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
               },
               {
                  name: "USN-3087-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-1",
               },
               {
                  name: "SUSE-SU-2016:2469",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
               },
               {
                  name: "openSUSE-SU-2016:2537",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
               },
               {
                  name: "USN-3087-2",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-2",
               },
               {
                  name: "SUSE-SU-2017:2699",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
               },
               {
                  name: "openSUSE-SU-2016:2407",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
               },
               {
                  name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2017/Jul/31",
               },
               {
                  name: "SUSE-SU-2016:2458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.f5.com/csp/article/K59298921",
               },
               {
                  name: "DSA-3673",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2016/dsa-3673",
               },
               {
                  name: "openSUSE-SU-2016:2391",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
               },
               {
                  name: "openSUSE-SU-2018:0458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
               },
               {
                  name: "SUSE-SU-2016:2387",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
               },
               {
                  name: "SUSE-SU-2016:2468",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
               },
               {
                  name: "SUSE-SU-2016:2394",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-08-19T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "92982",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/92982",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPUE",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "RHSA-2016:1940",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPSV",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               name: "1036690",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036690",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=1fb9fdc3027b27d8eb6a1e6a846435b070980770",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa132",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "FreeBSD-SA-16:26",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
            },
            {
               name: "SUSE-SU-2017:2700",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
            },
            {
               name: "USN-3087-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-1",
            },
            {
               name: "SUSE-SU-2016:2469",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
            },
            {
               name: "openSUSE-SU-2016:2537",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
            },
            {
               name: "USN-3087-2",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-2",
            },
            {
               name: "SUSE-SU-2017:2699",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
            },
            {
               name: "openSUSE-SU-2016:2407",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
            },
            {
               name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2017/Jul/31",
            },
            {
               name: "SUSE-SU-2016:2458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
            },
            {
               url: "https://support.f5.com/csp/article/K59298921",
            },
            {
               name: "DSA-3673",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.debian.org/security/2016/dsa-3673",
            },
            {
               name: "openSUSE-SU-2016:2391",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
            },
            {
               name: "openSUSE-SU-2018:0458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
            },
            {
               name: "SUSE-SU-2016:2387",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
            },
            {
               name: "SUSE-SU-2016:2468",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
            },
            {
               name: "SUSE-SU-2016:2394",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
            },
            {
               url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
            },
            {
               url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-2181",
      datePublished: "2016-09-16T00:00:00",
      dateReserved: "2016-01-29T00:00:00",
      dateUpdated: "2024-08-05T23:17:50.606Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-6306

Vulnerability from cvelistv5

Published

2016-09-26 00:00

Modified

2024-08-06 01:29

Severity ?

Summary

The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.

References

▼	URL	Tags
	https://www.tenable.com/security/tns-2016-20
	https://access.redhat.com/errata/RHSA-2018:2185	vendor-advisory
	https://access.redhat.com/errata/RHSA-2018:2186	vendor-advisory
	http://www.securityfocus.com/bid/93153	vdb-entry
	http://rhn.redhat.com/errata/RHSA-2016-1940.html	vendor-advisory
	https://security.gentoo.org/glsa/201612-16	vendor-advisory
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us
	http://www.securitytracker.com/id/1036885	vdb-entry
	https://www.tenable.com/security/tns-2016-16
	https://www.tenable.com/security/tns-2016-21
	https://bto.bluecoat.com/security-advisory/sa132
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html	vendor-advisory
	https://access.redhat.com/errata/RHSA-2018:2187	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	https://kc.mcafee.com/corporate/index?page=content&id=SB10215
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-2	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	vendor-advisory
	http://seclists.org/fulldisclosure/2017/Jul/31	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	vendor-advisory
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us
	http://www.debian.org/security/2016/dsa-3673	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448
	https://support.f5.com/csp/article/K90492697
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	vendor-advisory
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en
	https://www.oracle.com/security-alerts/cpuapr2020.html
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	https://www.oracle.com/security-alerts/cpujul2020.html
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
	https://www.oracle.com/security-alerts/cpujan2020.html
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
	https://www.openssl.org/news/secadv/20160922.txt
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9
	https://www.oracle.com/security-alerts/cpuoct2020.html
	https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T01:29:18.287Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  name: "RHSA-2018:2185",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2185",
               },
               {
                  name: "RHSA-2018:2186",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2186",
               },
               {
                  name: "93153",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/93153",
               },
               {
                  name: "RHSA-2016:1940",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
               },
               {
                  name: "GLSA-201612-16",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201612-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
               },
               {
                  name: "1036885",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036885",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa132",
               },
               {
                  name: "FreeBSD-SA-16:26",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
               },
               {
                  name: "SUSE-SU-2016:2470",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
               },
               {
                  name: "RHSA-2018:2187",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2187",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
               },
               {
                  name: "SUSE-SU-2017:2700",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
               },
               {
                  name: "USN-3087-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-1",
               },
               {
                  name: "SUSE-SU-2016:2469",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
               },
               {
                  name: "openSUSE-SU-2016:2537",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
               },
               {
                  name: "USN-3087-2",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-2",
               },
               {
                  name: "SUSE-SU-2017:2699",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
               },
               {
                  name: "openSUSE-SU-2016:2407",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
               },
               {
                  name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2017/Jul/31",
               },
               {
                  name: "SUSE-SU-2016:2458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us",
               },
               {
                  name: "DSA-3673",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2016/dsa-3673",
               },
               {
                  name: "openSUSE-SU-2016:2391",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
               },
               {
                  name: "openSUSE-SU-2018:0458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
               },
               {
                  name: "SUSE-SU-2016:2387",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.f5.com/csp/article/K90492697",
               },
               {
                  name: "SUSE-SU-2016:2468",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
               },
               {
                  name: "openSUSE-SU-2016:2496",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html",
               },
               {
                  name: "SUSE-SU-2016:2394",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.openssl.org/news/secadv/20160922.txt",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-09-22T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               name: "RHSA-2018:2185",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2185",
            },
            {
               name: "RHSA-2018:2186",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2186",
            },
            {
               name: "93153",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/93153",
            },
            {
               name: "RHSA-2016:1940",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
            },
            {
               name: "GLSA-201612-16",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/201612-16",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
            },
            {
               name: "1036885",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036885",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa132",
            },
            {
               name: "FreeBSD-SA-16:26",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
            },
            {
               name: "SUSE-SU-2016:2470",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
            },
            {
               name: "RHSA-2018:2187",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2187",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
            },
            {
               name: "SUSE-SU-2017:2700",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
            },
            {
               name: "USN-3087-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-1",
            },
            {
               name: "SUSE-SU-2016:2469",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
            },
            {
               name: "openSUSE-SU-2016:2537",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
            },
            {
               name: "USN-3087-2",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-2",
            },
            {
               name: "SUSE-SU-2017:2699",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
            },
            {
               name: "openSUSE-SU-2016:2407",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
            },
            {
               name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2017/Jul/31",
            },
            {
               name: "SUSE-SU-2016:2458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
            },
            {
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us",
            },
            {
               name: "DSA-3673",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.debian.org/security/2016/dsa-3673",
            },
            {
               name: "openSUSE-SU-2016:2391",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
            },
            {
               name: "openSUSE-SU-2018:0458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
            },
            {
               name: "SUSE-SU-2016:2387",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
            },
            {
               url: "https://support.f5.com/csp/article/K90492697",
            },
            {
               name: "SUSE-SU-2016:2468",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
            },
            {
               name: "openSUSE-SU-2016:2496",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html",
            },
            {
               name: "SUSE-SU-2016:2394",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
            },
            {
               url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujan2020.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
            },
            {
               url: "https://www.openssl.org/news/secadv/20160922.txt",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
            },
            {
               url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-6306",
      datePublished: "2016-09-26T00:00:00",
      dateReserved: "2016-07-26T00:00:00",
      dateUpdated: "2024-08-06T01:29:18.287Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-2177

Vulnerability from cvelistv5

Published

2016-06-20 00:00

Modified

2024-08-05 23:17

Severity ?

Summary

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.

References

▼	URL	Tags
	https://www.tenable.com/security/tns-2016-20
	http://www.splunk.com/view/SP-CAAAPUE
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	http://rhn.redhat.com/errata/RHSA-2017-1659.html	vendor-advisory
	https://access.redhat.com/errata/RHSA-2017:1658	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2016-1940.html	vendor-advisory
	http://www.securitytracker.com/id/1036088	vdb-entry
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
	https://security.gentoo.org/glsa/201612-16	vendor-advisory
	https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us
	http://www.splunk.com/view/SP-CAAAPSV
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	https://www.tenable.com/security/tns-2016-16
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=a004e72b95835136d3f1ea90517f706c24c03da7
	https://www.tenable.com/security/tns-2016-21
	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	https://access.redhat.com/errata/RHSA-2017:0194	vendor-advisory
	https://access.redhat.com/errata/RHSA-2017:0193	vendor-advisory
	https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/
	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
	http://rhn.redhat.com/errata/RHSA-2016-2957.html	vendor-advisory
	https://bto.bluecoat.com/security-advisory/sa132
	https://bugzilla.redhat.com/show_bug.cgi?id=1341705
	https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/
	http://www.securityfocus.com/bid/91319	vdb-entry
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03763en_us
	https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
	https://kc.mcafee.com/corporate/index?page=content&id=SB10165
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	http://www.openwall.com/lists/oss-security/2016/06/08/9	mailing-list
	https://kc.mcafee.com/corporate/index?page=content&id=SB10215
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	vendor-advisory
	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-2	vendor-advisory
	http://www.securityfocus.com/archive/1/540957/100/0/threaded	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	vendor-advisory
	http://www.securityfocus.com/archive/1/archive/1/540957/100/0/threaded	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	vendor-advisory
	http://seclists.org/fulldisclosure/2017/Jul/31	mailing-list
	http://www.ubuntu.com/usn/USN-3181-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	vendor-advisory
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us
	https://support.f5.com/csp/article/K23873366
	http://www.debian.org/security/2016/dsa-3673	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	vendor-advisory
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en
	https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T23:17:50.601Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPUE",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "RHSA-2017:1659",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-1659.html",
               },
               {
                  name: "RHSA-2017:1658",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1658",
               },
               {
                  name: "RHSA-2016:1940",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
               },
               {
                  name: "1036088",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036088",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
               },
               {
                  name: "GLSA-201612-16",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201612-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPSV",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=a004e72b95835136d3f1ea90517f706c24c03da7",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  name: "RHSA-2017:0194",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:0194",
               },
               {
                  name: "RHSA-2017:0193",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:0193",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
               },
               {
                  name: "RHSA-2016:2957",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa132",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1341705",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/",
               },
               {
                  name: "91319",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/91319",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "FreeBSD-SA-16:26",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03763en_us",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10165",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  name: "[oss-security] 20160608 CVE-2016-2177: OpenSSL undefined pointer arithmetic",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/9",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
               },
               {
                  name: "SUSE-SU-2017:2700",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
               },
               {
                  name: "USN-3087-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-1",
               },
               {
                  name: "SUSE-SU-2016:2469",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
               },
               {
                  name: "20160927 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl",
               },
               {
                  name: "openSUSE-SU-2016:2537",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
               },
               {
                  name: "USN-3087-2",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-2",
               },
               {
                  name: "20170801 [security bulletin] HPESBHF03763 rev.1 - HPE Comware 7, IMC, VCX products using OpenSSL, Remote Denial of Service (DoS)",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/540957/100/0/threaded",
               },
               {
                  name: "SUSE-SU-2017:2699",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
               },
               {
                  name: "20170801 [security bulletin] HPESBHF03763 rev.1 - HPE Comware 7, IMC, VCX products using OpenSSL, Remote Denial of Service (DoS)",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/archive/1/540957/100/0/threaded",
               },
               {
                  name: "openSUSE-SU-2016:2407",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
               },
               {
                  name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2017/Jul/31",
               },
               {
                  name: "USN-3181-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3181-1",
               },
               {
                  name: "SUSE-SU-2016:2458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.f5.com/csp/article/K23873366",
               },
               {
                  name: "DSA-3673",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2016/dsa-3673",
               },
               {
                  name: "openSUSE-SU-2016:2391",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
               },
               {
                  name: "openSUSE-SU-2018:0458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
               },
               {
                  name: "SUSE-SU-2016:2387",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
               },
               {
                  name: "SUSE-SU-2016:2468",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
               },
               {
                  name: "SUSE-SU-2016:2394",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-06-01T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPUE",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "RHSA-2017:1659",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-1659.html",
            },
            {
               name: "RHSA-2017:1658",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1658",
            },
            {
               name: "RHSA-2016:1940",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
            },
            {
               name: "1036088",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036088",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
            },
            {
               name: "GLSA-201612-16",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/201612-16",
            },
            {
               url: "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPSV",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=a004e72b95835136d3f1ea90517f706c24c03da7",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               name: "RHSA-2017:0194",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:0194",
            },
            {
               name: "RHSA-2017:0193",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:0193",
            },
            {
               url: "https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
            },
            {
               name: "RHSA-2016:2957",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa132",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1341705",
            },
            {
               url: "https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/",
            },
            {
               name: "91319",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/91319",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "FreeBSD-SA-16:26",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03763en_us",
            },
            {
               url: "https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10165",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               name: "[oss-security] 20160608 CVE-2016-2177: OpenSSL undefined pointer arithmetic",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/9",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
            },
            {
               name: "SUSE-SU-2017:2700",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
            },
            {
               name: "USN-3087-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-1",
            },
            {
               name: "SUSE-SU-2016:2469",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
            },
            {
               name: "20160927 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl",
            },
            {
               name: "openSUSE-SU-2016:2537",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
            },
            {
               name: "USN-3087-2",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-2",
            },
            {
               name: "20170801 [security bulletin] HPESBHF03763 rev.1 - HPE Comware 7, IMC, VCX products using OpenSSL, Remote Denial of Service (DoS)",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/540957/100/0/threaded",
            },
            {
               name: "SUSE-SU-2017:2699",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
            },
            {
               name: "20170801 [security bulletin] HPESBHF03763 rev.1 - HPE Comware 7, IMC, VCX products using OpenSSL, Remote Denial of Service (DoS)",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.securityfocus.com/archive/1/archive/1/540957/100/0/threaded",
            },
            {
               name: "openSUSE-SU-2016:2407",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
            },
            {
               name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2017/Jul/31",
            },
            {
               name: "USN-3181-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3181-1",
            },
            {
               name: "SUSE-SU-2016:2458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
            },
            {
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us",
            },
            {
               url: "https://support.f5.com/csp/article/K23873366",
            },
            {
               name: "DSA-3673",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.debian.org/security/2016/dsa-3673",
            },
            {
               name: "openSUSE-SU-2016:2391",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
            },
            {
               name: "openSUSE-SU-2018:0458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
            },
            {
               name: "SUSE-SU-2016:2387",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
            },
            {
               name: "SUSE-SU-2016:2468",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
            },
            {
               name: "SUSE-SU-2016:2394",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
            },
            {
               url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
            },
            {
               url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-2177",
      datePublished: "2016-06-20T00:00:00",
      dateReserved: "2016-01-29T00:00:00",
      dateUpdated: "2024-08-05T23:17:50.601Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-2178

Vulnerability from cvelistv5

Published

2016-06-20 00:00

Modified

2024-08-05 23:17

Severity ?

Summary

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

References

▼	URL	Tags
	https://www.tenable.com/security/tns-2016-20
	http://www.splunk.com/view/SP-CAAAPUE
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	http://rhn.redhat.com/errata/RHSA-2017-1659.html	vendor-advisory
	http://www.openwall.com/lists/oss-security/2016/06/09/8	mailing-list
	https://access.redhat.com/errata/RHSA-2017:1658	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2016-1940.html	vendor-advisory
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
	https://security.gentoo.org/glsa/201612-16	vendor-advisory
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us
	http://www.splunk.com/view/SP-CAAAPSV
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
	https://www.tenable.com/security/tns-2016-16
	https://www.tenable.com/security/tns-2016-21
	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=399944622df7bd81af62e67ea967c470534090e2
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	http://www.securityfocus.com/bid/91081	vdb-entry
	https://access.redhat.com/errata/RHSA-2017:0194	vendor-advisory
	http://www.openwall.com/lists/oss-security/2016/06/08/2	mailing-list
	https://access.redhat.com/errata/RHSA-2017:0193	vendor-advisory
	https://bugzilla.redhat.com/show_bug.cgi?id=1343400
	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
	http://rhn.redhat.com/errata/RHSA-2016-2957.html	vendor-advisory
	https://bto.bluecoat.com/security-advisory/sa132
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
	http://www.securitytracker.com/id/1036054	vdb-entry
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	http://eprint.iacr.org/2016/594.pdf
	https://kc.mcafee.com/corporate/index?page=content&id=SB10215
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	vendor-advisory
	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl	vendor-advisory
	http://www.openwall.com/lists/oss-security/2016/06/08/8	mailing-list
	http://www.openwall.com/lists/oss-security/2016/06/08/4	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	vendor-advisory
	http://www.openwall.com/lists/oss-security/2016/06/08/6	mailing-list
	https://support.f5.com/csp/article/K53084033
	http://www.ubuntu.com/usn/USN-3087-2	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	vendor-advisory
	http://seclists.org/fulldisclosure/2017/Jul/31	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	vendor-advisory
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us
	http://www.openwall.com/lists/oss-security/2016/06/08/10	mailing-list
	http://www.openwall.com/lists/oss-security/2016/06/08/11	mailing-list
	http://www.openwall.com/lists/oss-security/2016/06/08/5	mailing-list
	http://www.debian.org/security/2016/dsa-3673	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	vendor-advisory
	http://www.openwall.com/lists/oss-security/2016/06/08/12	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html	vendor-advisory
	http://www.openwall.com/lists/oss-security/2016/06/08/7	mailing-list
	http://www.openwall.com/lists/oss-security/2016/06/09/2	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	vendor-advisory
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en
	https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T23:17:50.594Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPUE",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "RHSA-2017:1659",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-1659.html",
               },
               {
                  name: "[oss-security] 20160609 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/09/8",
               },
               {
                  name: "RHSA-2017:1658",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1658",
               },
               {
                  name: "RHSA-2016:1940",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
               },
               {
                  name: "GLSA-201612-16",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201612-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPSV",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=399944622df7bd81af62e67ea967c470534090e2",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  name: "91081",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/91081",
               },
               {
                  name: "RHSA-2017:0194",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:0194",
               },
               {
                  name: "[oss-security] 20160608 CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/2",
               },
               {
                  name: "RHSA-2017:0193",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:0193",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1343400",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
               },
               {
                  name: "RHSA-2016:2957",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa132",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "FreeBSD-SA-16:26",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
               },
               {
                  name: "SUSE-SU-2016:2470",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
               },
               {
                  name: "1036054",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036054",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://eprint.iacr.org/2016/594.pdf",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
               },
               {
                  name: "SUSE-SU-2017:2700",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
               },
               {
                  name: "USN-3087-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-1",
               },
               {
                  name: "SUSE-SU-2016:2469",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
               },
               {
                  name: "20160927 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl",
               },
               {
                  name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/8",
               },
               {
                  name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/4",
               },
               {
                  name: "openSUSE-SU-2016:2537",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
               },
               {
                  name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/6",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.f5.com/csp/article/K53084033",
               },
               {
                  name: "USN-3087-2",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-2",
               },
               {
                  name: "SUSE-SU-2017:2699",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
               },
               {
                  name: "openSUSE-SU-2016:2407",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
               },
               {
                  name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2017/Jul/31",
               },
               {
                  name: "SUSE-SU-2016:2458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us",
               },
               {
                  name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/10",
               },
               {
                  name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/11",
               },
               {
                  name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/5",
               },
               {
                  name: "DSA-3673",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2016/dsa-3673",
               },
               {
                  name: "openSUSE-SU-2016:2391",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
               },
               {
                  name: "openSUSE-SU-2018:0458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
               },
               {
                  name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/12",
               },
               {
                  name: "SUSE-SU-2016:2387",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
               },
               {
                  name: "SUSE-SU-2016:2468",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
               },
               {
                  name: "openSUSE-SU-2016:2496",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html",
               },
               {
                  name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/08/7",
               },
               {
                  name: "[oss-security] 20160609 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/06/09/2",
               },
               {
                  name: "SUSE-SU-2016:2394",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-06-06T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPUE",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "RHSA-2017:1659",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-1659.html",
            },
            {
               name: "[oss-security] 20160609 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/09/8",
            },
            {
               name: "RHSA-2017:1658",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1658",
            },
            {
               name: "RHSA-2016:1940",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
            },
            {
               name: "GLSA-201612-16",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/201612-16",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPSV",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=399944622df7bd81af62e67ea967c470534090e2",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               name: "91081",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/91081",
            },
            {
               name: "RHSA-2017:0194",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:0194",
            },
            {
               name: "[oss-security] 20160608 CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/2",
            },
            {
               name: "RHSA-2017:0193",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:0193",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1343400",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
            },
            {
               name: "RHSA-2016:2957",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa132",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "FreeBSD-SA-16:26",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
            },
            {
               name: "SUSE-SU-2016:2470",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
            },
            {
               name: "1036054",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036054",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               url: "http://eprint.iacr.org/2016/594.pdf",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
            },
            {
               name: "SUSE-SU-2017:2700",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
            },
            {
               name: "USN-3087-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-1",
            },
            {
               name: "SUSE-SU-2016:2469",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
            },
            {
               name: "20160927 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl",
            },
            {
               name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/8",
            },
            {
               name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/4",
            },
            {
               name: "openSUSE-SU-2016:2537",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
            },
            {
               name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/6",
            },
            {
               url: "https://support.f5.com/csp/article/K53084033",
            },
            {
               name: "USN-3087-2",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-2",
            },
            {
               name: "SUSE-SU-2017:2699",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
            },
            {
               name: "openSUSE-SU-2016:2407",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
            },
            {
               name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2017/Jul/31",
            },
            {
               name: "SUSE-SU-2016:2458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
            },
            {
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us",
            },
            {
               name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/10",
            },
            {
               name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/11",
            },
            {
               name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/5",
            },
            {
               name: "DSA-3673",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.debian.org/security/2016/dsa-3673",
            },
            {
               name: "openSUSE-SU-2016:2391",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
            },
            {
               name: "openSUSE-SU-2018:0458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
            },
            {
               name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/12",
            },
            {
               name: "SUSE-SU-2016:2387",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448",
            },
            {
               name: "SUSE-SU-2016:2468",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
            },
            {
               name: "openSUSE-SU-2016:2496",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html",
            },
            {
               name: "[oss-security] 20160608 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/08/7",
            },
            {
               name: "[oss-security] 20160609 Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/06/09/2",
            },
            {
               name: "SUSE-SU-2016:2394",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
            },
            {
               url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
            },
            {
               url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-2178",
      datePublished: "2016-06-20T00:00:00",
      dateReserved: "2016-01-29T00:00:00",
      dateUpdated: "2024-08-05T23:17:50.594Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-6302

Vulnerability from cvelistv5

Published

2016-09-16 00:00

Modified

2024-08-06 01:29

Severity ?

Summary

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.

References

▼	URL	Tags
	https://www.tenable.com/security/tns-2016-20
	https://access.redhat.com/errata/RHSA-2018:2185	vendor-advisory
	https://access.redhat.com/errata/RHSA-2018:2186	vendor-advisory
	http://www.splunk.com/view/SP-CAAAPUE
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	http://rhn.redhat.com/errata/RHSA-2016-1940.html	vendor-advisory
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
	http://www.securityfocus.com/bid/92628	vdb-entry
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=e97763c92c655dcf4af2860b3abd2bc4c8a267f9
	http://www.splunk.com/view/SP-CAAAPSV
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	http://www.securitytracker.com/id/1036885	vdb-entry
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	https://www.tenable.com/security/tns-2016-16
	https://www.tenable.com/security/tns-2016-21
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
	https://bto.bluecoat.com/security-advisory/sa132
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	vendor-advisory
	https://access.redhat.com/errata/RHSA-2018:2187	vendor-advisory
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T01:29:18.217Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  name: "RHSA-2018:2185",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2185",
               },
               {
                  name: "RHSA-2018:2186",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2186",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPUE",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "RHSA-2016:1940",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
               },
               {
                  name: "92628",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/92628",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=e97763c92c655dcf4af2860b3abd2bc4c8a267f9",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPSV",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  name: "1036885",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036885",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa132",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "FreeBSD-SA-16:26",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
               },
               {
                  name: "RHSA-2018:2187",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2187",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-08-23T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               name: "RHSA-2018:2185",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2185",
            },
            {
               name: "RHSA-2018:2186",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2186",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPUE",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "RHSA-2016:1940",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
            },
            {
               name: "92628",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/92628",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=e97763c92c655dcf4af2860b3abd2bc4c8a267f9",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPSV",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               name: "1036885",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036885",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa132",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "FreeBSD-SA-16:26",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
            },
            {
               name: "RHSA-2018:2187",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2187",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-6302",
      datePublished: "2016-09-16T00:00:00",
      dateReserved: "2016-07-26T00:00:00",
      dateUpdated: "2024-08-06T01:29:18.217Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-6304

Vulnerability from cvelistv5

Published

2016-09-26 00:00

Modified

2024-08-06 01:29

Severity ?

Summary

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20160922.txt
	https://www.tenable.com/security/tns-2016-20
	http://www.splunk.com/view/SP-CAAAPUE
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
	http://rhn.redhat.com/errata/RHSA-2017-1659.html	vendor-advisory
	https://access.redhat.com/errata/RHSA-2017:1658	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2016-1940.html	vendor-advisory
	http://www.securityfocus.com/bid/93150	vdb-entry
	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
	http://rhn.redhat.com/errata/RHSA-2016-2802.html	vendor-advisory
	https://security.gentoo.org/glsa/201612-16	vendor-advisory
	https://access.redhat.com/errata/RHSA-2017:1801	vendor-advisory
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
	http://www.securitytracker.com/id/1036878	vdb-entry
	http://www.splunk.com/view/SP-CAAAPSV
	https://access.redhat.com/errata/RHSA-2017:1413	vendor-advisory
	http://www-01.ibm.com/support/docview.wss?uid=swg21995039
	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
	https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
	https://www.tenable.com/security/tns-2016-16
	https://access.redhat.com/errata/RHSA-2017:2494	vendor-advisory
	http://www.securitytracker.com/id/1037640	vdb-entry
	https://www.tenable.com/security/tns-2016-21
	https://kc.mcafee.com/corporate/index?page=content&id=SB10171
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
	https://access.redhat.com/errata/RHSA-2017:1414	vendor-advisory
	http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
	https://bto.bluecoat.com/security-advisory/sa132
	http://rhn.redhat.com/errata/RHSA-2017-1415.html	vendor-advisory
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html	vendor-advisory
	https://access.redhat.com/errata/RHSA-2017:1802	vendor-advisory
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	https://access.redhat.com/errata/RHSA-2017:2493	vendor-advisory
	https://kc.mcafee.com/corporate/index?page=content&id=SB10215
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-3087-1	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html	vendor-advisory
	http://seclists.org/fulldisclosure/2016/Oct/62	mailing-list
	http://www.ubuntu.com/usn/USN-3087-2	vendor-advisory
	http://seclists.org/fulldisclosure/2016/Dec/47	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html	vendor-advisory
	http://seclists.org/fulldisclosure/2017/Jul/31	mailing-list
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html	vendor-advisory
	http://www.debian.org/security/2016/dsa-3673	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html	vendor-advisory
	http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html	vendor-advisory
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en
	https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T01:29:18.286Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.openssl.org/news/secadv/20160922.txt",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-20",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPUE",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "RHSA-2017:1659",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-1659.html",
               },
               {
                  name: "RHSA-2017:1658",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1658",
               },
               {
                  name: "RHSA-2016:1940",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
               },
               {
                  name: "93150",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/93150",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
               },
               {
                  name: "RHSA-2016:2802",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-2802.html",
               },
               {
                  name: "GLSA-201612-16",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201612-16",
               },
               {
                  name: "RHSA-2017:1801",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1801",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
               },
               {
                  name: "1036878",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036878",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.splunk.com/view/SP-CAAAPSV",
               },
               {
                  name: "RHSA-2017:1413",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1413",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-16",
               },
               {
                  name: "RHSA-2017:2494",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2494",
               },
               {
                  name: "1037640",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1037640",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-21",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10171",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  name: "RHSA-2017:1414",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1414",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa132",
               },
               {
                  name: "RHSA-2017:1415",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-1415.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "FreeBSD-SA-16:26",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
               },
               {
                  name: "SUSE-SU-2016:2470",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
               },
               {
                  name: "RHSA-2017:1802",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1802",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  name: "RHSA-2017:2493",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2493",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
               },
               {
                  name: "SUSE-SU-2017:2700",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
               },
               {
                  name: "USN-3087-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-1",
               },
               {
                  name: "SUSE-SU-2016:2469",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
               },
               {
                  name: "openSUSE-SU-2016:2537",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
               },
               {
                  name: "20161012 New OpenSSL double-free and invalid free vulnerabilities in X509 parsing",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2016/Oct/62",
               },
               {
                  name: "USN-3087-2",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-3087-2",
               },
               {
                  name: "20161214 APPLE-SA-2016-12-13-1 macOS 10.12.2",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2016/Dec/47",
               },
               {
                  name: "SUSE-SU-2017:2699",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
               },
               {
                  name: "openSUSE-SU-2016:2407",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
               },
               {
                  name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2017/Jul/31",
               },
               {
                  name: "SUSE-SU-2016:2458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
               },
               {
                  name: "DSA-3673",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2016/dsa-3673",
               },
               {
                  name: "openSUSE-SU-2016:2391",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
               },
               {
                  name: "openSUSE-SU-2018:0458",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html",
               },
               {
                  name: "SUSE-SU-2016:2387",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
               },
               {
                  name: "openSUSE-SU-2016:2788",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html",
               },
               {
                  name: "SUSE-SU-2016:2468",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
               },
               {
                  name: "openSUSE-SU-2016:2769",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html",
               },
               {
                  name: "openSUSE-SU-2016:2496",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html",
               },
               {
                  name: "SUSE-SU-2016:2394",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-09-22T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://www.openssl.org/news/secadv/20160922.txt",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-20",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPUE",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "RHSA-2017:1659",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-1659.html",
            },
            {
               name: "RHSA-2017:1658",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1658",
            },
            {
               name: "RHSA-2016:1940",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-1940.html",
            },
            {
               name: "93150",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/93150",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
            },
            {
               name: "RHSA-2016:2802",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-2802.html",
            },
            {
               name: "GLSA-201612-16",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/201612-16",
            },
            {
               name: "RHSA-2017:1801",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1801",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
            },
            {
               name: "1036878",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1036878",
            },
            {
               url: "http://www.splunk.com/view/SP-CAAAPSV",
            },
            {
               name: "RHSA-2017:1413",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1413",
            },
            {
               url: "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            },
            {
               url: "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-16",
            },
            {
               name: "RHSA-2017:2494",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2494",
            },
            {
               name: "1037640",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1037640",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-21",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10171",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               name: "RHSA-2017:1414",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1414",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa132",
            },
            {
               name: "RHSA-2017:1415",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-1415.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "FreeBSD-SA-16:26",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc",
            },
            {
               name: "SUSE-SU-2016:2470",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
            },
            {
               name: "RHSA-2017:1802",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1802",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               name: "RHSA-2017:2493",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2493",
            },
            {
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10215",
            },
            {
               name: "SUSE-SU-2017:2700",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html",
            },
            {
               name: "USN-3087-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-1",
            },
            {
               name: "SUSE-SU-2016:2469",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html",
            },
            {
               name: "openSUSE-SU-2016:2537",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html",
            },
            {
               name: "20161012 New OpenSSL double-free and invalid free vulnerabilities in X509 parsing",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2016/Oct/62",
            },
            {
               name: "USN-3087-2",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-3087-2",
            },
            {
               name: "20161214 APPLE-SA-2016-12-13-1 macOS 10.12.2",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2016/Dec/47",
            },
            {
               name: "SUSE-SU-2017:2699",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html",
            },
            {
               name: "openSUSE-SU-2016:2407",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html",
            },
            {
               name: "20170717 Orion Elite Hidden IP Browser Pro - All Versions - Multiple Known Vulnerabilities",
               tags: [
                  "mailing-list",
               ],
               url: "http://seclists.org/fulldisclosure/2017/Jul/31",
            },
            {
               name: "SUSE-SU-2016:2458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html",
            },
            {
               name: "DSA-3673",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.debian.org/security/2016/dsa-3673",
            },
            {
               name: "openSUSE-SU-2016:2391",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html",
            },
            {
               name: "openSUSE-SU-2018:0458",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html",
            },
            {
               url: "http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html",
            },
            {
               name: "SUSE-SU-2016:2387",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html",
            },
            {
               name: "openSUSE-SU-2016:2788",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html",
            },
            {
               name: "SUSE-SU-2016:2468",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html",
            },
            {
               name: "openSUSE-SU-2016:2769",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html",
            },
            {
               name: "openSUSE-SU-2016:2496",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html",
            },
            {
               name: "SUSE-SU-2016:2394",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html",
            },
            {
               url: "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en",
            },
            {
               url: "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-6304",
      datePublished: "2016-09-26T00:00:00",
      dateReserved: "2016-07-26T00:00:00",
      dateUpdated: "2024-08-06T01:29:18.286Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature