CVE-2016-2109

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

Affected Software

Name	Vendor	Start Version	End Version
Openssl	Openssl	*	1.0.1s (including)
Openssl	Openssl	1.0.2 (including)	1.0.2 (including)
Openssl	Openssl	1.0.2-beta1 (including)	1.0.2-beta1 (including)
Openssl	Openssl	1.0.2-beta2 (including)	1.0.2-beta2 (including)
Openssl	Openssl	1.0.2-beta3 (including)	1.0.2-beta3 (including)
Openssl	Openssl	1.0.2a (including)	1.0.2a (including)
Openssl	Openssl	1.0.2b (including)	1.0.2b (including)
Openssl	Openssl	1.0.2c (including)	1.0.2c (including)
Openssl	Openssl	1.0.2d (including)	1.0.2d (including)
Openssl	Openssl	1.0.2e (including)	1.0.2e (including)
Openssl	Openssl	1.0.2f (including)	1.0.2f (including)
Openssl	Openssl	1.0.2g (including)	1.0.2g (including)
Red Hat Enterprise Linux 6	RedHat	openssl-0:1.0.1e-48.el6_8.1	*
Red Hat Enterprise Linux 6.7 Extended Update Support	RedHat	openssl-0:1.0.1e-42.el6_7.5	*
Red Hat Enterprise Linux 7	RedHat	openssl-1:1.0.1e-51.el7_2.5	*
Red Hat JBoss Enterprise Application Platform 6.4	RedHat	openssl	*
Text-Only JBCS	RedHat		*
Openssl	Ubuntu	artful	*
Openssl	Ubuntu	bionic	*
Openssl	Ubuntu	cosmic	*
Openssl	Ubuntu	devel	*
Openssl	Ubuntu	disco	*
Openssl	Ubuntu	esm-infra-legacy/trusty	*
Openssl	Ubuntu	esm-infra/bionic	*
Openssl	Ubuntu	esm-infra/xenial	*
Openssl	Ubuntu	precise	*
Openssl	Ubuntu	trusty	*
Openssl	Ubuntu	trusty/esm	*
Openssl	Ubuntu	upstream	*
Openssl	Ubuntu	vivid/stable-phone-overlay	*
Openssl	Ubuntu	vivid/ubuntu-core	*
Openssl	Ubuntu	wily	*
Openssl	Ubuntu	xenial	*
Openssl	Ubuntu	yakkety	*
Openssl	Ubuntu	zesty	*
Openssl098	Ubuntu	precise	*
Openssl098	Ubuntu	trusty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-2109
CWE	https://cwe.mitre.org/data/definitions/399.html

Affected Software

References