CVE-2016-0797

Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.

Affected Software

Name	Vendor	Start Version	End Version
Openssl	Openssl	1.0.1 (including)	1.0.1 (including)
Openssl	Openssl	1.0.1-beta1 (including)	1.0.1-beta1 (including)
Openssl	Openssl	1.0.1-beta2 (including)	1.0.1-beta2 (including)
Openssl	Openssl	1.0.1-beta3 (including)	1.0.1-beta3 (including)
Openssl	Openssl	1.0.1a (including)	1.0.1a (including)
Openssl	Openssl	1.0.1b (including)	1.0.1b (including)
Openssl	Openssl	1.0.1c (including)	1.0.1c (including)
Openssl	Openssl	1.0.1d (including)	1.0.1d (including)
Openssl	Openssl	1.0.1e (including)	1.0.1e (including)
Openssl	Openssl	1.0.1f (including)	1.0.1f (including)
Openssl	Openssl	1.0.1g (including)	1.0.1g (including)
Openssl	Openssl	1.0.1h (including)	1.0.1h (including)
Openssl	Openssl	1.0.1i (including)	1.0.1i (including)
Openssl	Openssl	1.0.1j (including)	1.0.1j (including)
Openssl	Openssl	1.0.1k (including)	1.0.1k (including)
Openssl	Openssl	1.0.1l (including)	1.0.1l (including)
Openssl	Openssl	1.0.1m (including)	1.0.1m (including)
Openssl	Openssl	1.0.1n (including)	1.0.1n (including)
Openssl	Openssl	1.0.1o (including)	1.0.1o (including)
Openssl	Openssl	1.0.1p (including)	1.0.1p (including)
Openssl	Openssl	1.0.1q (including)	1.0.1q (including)
Openssl	Openssl	1.0.1r (including)	1.0.1r (including)
Openssl	Openssl	1.0.2 (including)	1.0.2 (including)
Openssl	Openssl	1.0.2-beta1 (including)	1.0.2-beta1 (including)
Openssl	Openssl	1.0.2-beta2 (including)	1.0.2-beta2 (including)
Openssl	Openssl	1.0.2-beta3 (including)	1.0.2-beta3 (including)
Openssl	Openssl	1.0.2a (including)	1.0.2a (including)
Openssl	Openssl	1.0.2b (including)	1.0.2b (including)
Openssl	Openssl	1.0.2c (including)	1.0.2c (including)
Openssl	Openssl	1.0.2d (including)	1.0.2d (including)
Openssl	Openssl	1.0.2e (including)	1.0.2e (including)
Openssl	Openssl	1.0.2f (including)	1.0.2f (including)
Red Hat Enterprise Linux 5	RedHat	openssl-0:0.9.8e-39.el5_11	*
Red Hat Enterprise Linux 6	RedHat	openssl-0:1.0.1e-42.el6_7.4	*
Red Hat Enterprise Linux 7	RedHat	openssl-1:1.0.1e-51.el7_2.4	*
RHEV 3.X Hypervisor and Agents for RHEL-6	RedHat	rhev-hypervisor7-0:7.2-20160302.1.el6ev	*
RHEV 3.X Hypervisor and Agents for RHEL-7	RedHat	rhev-hypervisor7-0:7.2-20160302.1.el7ev	*
Text-Only JBCS	RedHat		*
Openssl	Ubuntu	artful	*
Openssl	Ubuntu	bionic	*
Openssl	Ubuntu	cosmic	*
Openssl	Ubuntu	devel	*
Openssl	Ubuntu	disco	*
Openssl	Ubuntu	esm-infra-legacy/trusty	*
Openssl	Ubuntu	esm-infra/bionic	*
Openssl	Ubuntu	esm-infra/xenial	*
Openssl	Ubuntu	precise	*
Openssl	Ubuntu	trusty	*
Openssl	Ubuntu	trusty/esm	*
Openssl	Ubuntu	vivid/stable-phone-overlay	*
Openssl	Ubuntu	vivid/ubuntu-core	*
Openssl	Ubuntu	wily	*
Openssl	Ubuntu	xenial	*
Openssl	Ubuntu	yakkety	*
Openssl	Ubuntu	zesty	*
Openssl098	Ubuntu	precise	*
Openssl098	Ubuntu	trusty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-0797
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References