The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

OSVersionArchitecturePackageVersionFilename
Debian12allopenssl< 1.0.2h-1openssl_1.0.2h-1_all.deb
Debian11allopenssl< 1.0.2h-1openssl_1.0.2h-1_all.deb
Debian10allopenssl< 1.0.2h-1openssl_1.0.2h-1_all.deb
Debian999allopenssl< 1.0.2h-1openssl_1.0.2h-1_all.deb
Debian13allopenssl< 1.0.2h-1openssl_1.0.2h-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	openssl	< 1.0.2h-1	openssl_1.0.2h-1_all.deb
Debian	11	all	openssl	< 1.0.2h-1	openssl_1.0.2h-1_all.deb
Debian	10	all	openssl	< 1.0.2h-1	openssl_1.0.2h-1_all.deb
Debian	999	all	openssl	< 1.0.2h-1	openssl_1.0.2h-1_all.deb
Debian	13	all	openssl	< 1.0.2h-1	openssl_1.0.2h-1_all.deb

cve 1

hackerone 1

f5 4

ubuntucve 1

nessus 46

alpinelinux 1

prion 1

osv 3

veracode 1

openssl 1

ibm 52

openvas 36

oraclelinux 4

suse 15

mageia 1

paloalto 1

freebsd_advisory 1

ubuntu 1

altlinux 5

amazon 1

aix 1

cloudfoundry 1

nodejsblog 1

debian 2

slackware 1

freebsd 1

fortinet 1

archlinux 2

huawei 1

arista 1

cisco 1

fedora 2

centos 2

redhat 3

symantec 1

gentoo 1

cve

CVE-2016-2109

2016-05-05 01:59:00

hackerone

Internet Bug Bounty: ASN.1 BIO excessive memory allocation (CVE-2016-2109)

2016-04-26 22:31:48

K23230229 : OpenSSL vulnerability CVE-2016-2109

2016-05-07 00:00:00

SOL23230229 - OpenSSL vulnerability CVE-2016-2109

2016-05-06 00:00:00

K07538415 : Multiple OpenSSL vulnerabilities

2016-05-04 00:00:00

ubuntucve

CVE-2016-2109

2016-04-25 00:00:00

nessus

F5 Networks BIG-IP : OpenSSL vulnerability (K23230229)

2016-11-21 00:00:00

Blue Coat ProxySG 6.5.x < 6.5.9.8 / 6.6.x < 6.6.4.1 Multiple OpenSSL Vulnerabilities

2016-09-08 00:00:00

EulerOS 2.0 SP3 : openssl098e (EulerOS-SA-2019-2271)

2019-11-08 00:00:00

alpinelinux

CVE-2016-2109

2016-05-05 01:59:00

prion

Information disclosure

2016-05-05 01:59:00

osv

CVE-2016-2109

2016-05-05 01:59:00

openssl - security update

2016-05-03 00:00:00

openssl - security update

2016-05-03 00:00:00

veracode

Denial Of Service (DoS)

2017-01-27 02:30:54

openssl

Vulnerability in OpenSSL CVE-2016-2109

2016-05-03 00:00:00

ibm

Security Bulletin: Vulnerabilities in OpenSSL affect IBM WebSphere MQ (CVE-2016-2106, CVE-2016-2109)

2018-06-15 07:07:04

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Systems Director (CVE-2016-2108,CVE-2016-2109,CVE-2016-2176)

2018-06-18 01:32:59

Security Bulletin: IBM WebSphere MQ Advanced Message Security for IBM i へのOpenSSLの脆弱性 (CVE-2016-2106, CVE-2016-2109)

2018-06-15 07:07:07

openvas

Huawei EulerOS: Security Advisory for openssl098e (EulerOS-SA-2019-2271)

2020-01-23 00:00:00

Mageia: Security Advisory (MGASA-2016-0169)

2016-05-09 00:00:00

SUSE: Security Advisory (SUSE-SU-2016:1228-1)

2021-04-19 00:00:00

oraclelinux

openssl security update

2016-06-21 00:00:00

openssl security update

2016-05-09 00:00:00

openssl-fips security update

2016-06-15 00:00:00

suse

Security update for compat-openssl097g (important)

2016-05-04 18:08:19

Security update for openssl (important)

2016-05-05 13:11:19

Security update for openssl (important)

2016-05-05 18:08:51

mageia

Updated openssl packages fix security vulnerability

2016-05-08 00:22:48

paloalto

OpenSSL Vulnerabilities

2016-09-02 00:00:00

freebsd_advisory

FreeBSD-SA-16:17.openssl

2016-05-04 00:00:00

ubuntu

OpenSSL vulnerabilities

2016-05-03 00:00:00

altlinux

Security fix for the ALT Linux 9 package openssl1.1 version 1.0.2h-alt1

2016-05-03 00:00:00

Security fix for the ALT Linux 10 package openssl1.1 version 1.0.2h-alt1

2016-05-03 00:00:00

Security fix for the ALT Linux 8 package openssl10 version 1.0.2h-alt1

2016-05-04 00:00:00

amazon

Important: openssl

2016-05-03 10:30:00

aix

Vulnerabilities in OpenSSL affect AIX

2016-07-12 14:14:43

cloudfoundry

USN-2959-1 OpenSSL vulnerabilities | Cloud Foundry

2016-05-06 00:00:00

nodejsblog

OpenSSL updates, 1.0.1t and 1.0.2h

2016-05-02 00:00:00

debian

[SECURITY] [DLA 456-1] openssl security update

2016-05-03 20:53:46

[SECURITY] [DSA 3566-1] openssl security update

2016-05-03 18:24:21

slackware

[slackware-security] openssl

2016-05-03 21:05:31

freebsd

OpenSSL -- multiple vulnerabilities

2016-05-03 00:00:00

fortinet

OpenSSL Advisory - May 2016

2016-09-22 00:00:00

archlinux

openssl: multiple issues

2016-05-04 00:00:00

lib32-openssl: multiple issues

2016-05-04 00:00:00

huawei

Security Advisory - Multiple Vulnerabilities in OpenSSL in May 2016

2016-07-06 00:00:00

arista

Security Advisory 0020

2016-05-06 00:00:00

cisco

Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016

2016-05-04 19:30:00

fedora

[SECURITY] Fedora 23 Update: mingw-openssl-1.0.2h-1.fc23

2016-05-21 00:02:56

[SECURITY] Fedora 24 Update: mingw-openssl-1.0.2h-1.fc24

2016-05-16 17:21:44

centos

openssl security update

2016-05-16 10:25:52

openssl security update

2016-05-09 08:40:50

redhat

(RHSA-2016:0722) Important: openssl security update

2016-05-09 04:44:04

(RHSA-2016:0996) Important: openssl security update

2016-05-10 07:00:21

(RHSA-2016:2073) Important: openssl security update

2016-10-18 06:21:20

symantec

SA123 : OpenSSL Vulnerabilities 3-May-2016

2016-05-09 08:00:00

gentoo

OpenSSL: Multiple vulnerabilities

2016-12-07 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.842 High

EPSS

Percentile

98.5%

JSON

Related for DEBIANCVE:CVE-2016-2109