VulnerabilityModified

CVE-2016-2105

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.

HIGH 7.5EPSS 39.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 39.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 39.65% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-190
Affected: redhat/enterprise linux desktop · redhat/enterprise linux hpc node · redhat/enterprise linux server · redhat/enterprise linux workstation · opensuse/leap · opensuse/opensuse · oracle/mysql · redhat/enterprise linux hpc node eus · redhat/enterprise linux server aus · redhat/enterprise linux server eus · apple/mac os x · openssl/openssl · debian/debian linux · canonical/ubuntu linux · nodejs/node.js
Source: secalert@redhat.com

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759Third Party Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.htmlThird Party Advisory
http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.htmlThird Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-0722.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0996.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1648.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1649.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1650.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2056.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2073.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2957.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.