CVE-2016-2105

critical-risk
Published 2016-05-05

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.

Do I need to act?

!
45.1% chance of exploitation in next 30 days
EPSS score — higher than 55% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Redhat Openssl Nodejs Oracle Apple Canonical Opensuse Debian

References (122)

Third Party Advisory http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
Mailing List http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html
and 102 more references
70
/ 100
critical-risk
Severity 26/34 · High
Exploitability 17/34 · Moderate
Exposure 27/34 · High