Veracode Vulnerability DatabaseVERACODE:12052Arbitrary Code Execution Or Denial Of Service (DoS)
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
OpenSSL is vulnerable to arbitrary code execution or denial of service attacks. Due to a flaw, an attacker can use a certificate which leads to a crash or execution of arbitrary code upon verification or re-encoding of certificate by OpenSSL.
References
kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html
lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html
packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html
rhn.redhat.com/errata/RHSA-2016-0722.html
rhn.redhat.com/errata/RHSA-2016-0996.html
rhn.redhat.com/errata/RHSA-2016-2056.html
rhn.redhat.com/errata/RHSA-2016-2073.html
rhn.redhat.com/errata/RHSA-2016-2957.html
source.android.com/security/bulletin/2016-07-01.html
support.citrix.com/article/CTX212736
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl
www.debian.org/security/2016/dsa-3566
www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
www.securityfocus.com/bid/89752
www.securityfocus.com/bid/91787
www.securitytracker.com/id/1035721
www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103
www.ubuntu.com/usn/USN-2959-1
access.redhat.com/errata/RHSA-2016:1137
access.redhat.com/errata/RHSA-2017:0193
access.redhat.com/errata/RHSA-2017:0194
access.redhat.com/security/updates/classification/#important
bto.bluecoat.com/security-advisory/sa123
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
git.openssl.org/?p=openssl.git;a=commit;h=3661bb4e7934668bd99ca777ea8b30eedfafa871
git.openssl.org/?p=openssl.git;a=commit;h=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27
h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us
h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us
h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067&languageid=en-fr
security.gentoo.org/glsa/201612-16
security.netapp.com/advisory/ntap-20160504-0001/
support.apple.com/HT206903
www.openssl.org/news/secadv/20160503.txt
www.tenable.com/security/tns-2016-18
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C