CVE-2016-2108
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 High
AI Score
Confidence
High
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.893 High
EPSS
Percentile
98.7%
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the “negative zero” issue.
References
kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html
packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html
rhn.redhat.com/errata/RHSA-2016-0722.html
rhn.redhat.com/errata/RHSA-2016-0996.html
rhn.redhat.com/errata/RHSA-2016-2056.html
rhn.redhat.com/errata/RHSA-2016-2073.html
rhn.redhat.com/errata/RHSA-2016-2957.html
source.android.com/security/bulletin/2016-07-01.html
support.citrix.com/article/CTX212736
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl
www.debian.org/security/2016/dsa-3566
www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
www.securityfocus.com/bid/89752
www.securityfocus.com/bid/91787
www.securitytracker.com/id/1035721
www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103
www.ubuntu.com/usn/USN-2959-1
access.redhat.com/errata/RHSA-2016:1137
access.redhat.com/errata/RHSA-2017:0193
access.redhat.com/errata/RHSA-2017:0194
bto.bluecoat.com/security-advisory/sa123
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3661bb4e7934668bd99ca777ea8b30eedfafa871
git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27
h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us
h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us
h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067&languageid=en-fr
security.gentoo.org/glsa/201612-16
security.netapp.com/advisory/ntap-20160504-0001/
support.apple.com/HT206903
www.openssl.org/news/secadv/20160503.txt
www.tenable.com/security/tns-2016-18
Social References
More
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 High
AI Score
Confidence
High
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.893 High
EPSS
Percentile
98.7%