Vulnerability Description
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hp | Icewall Mcrp | 3.0 |
| Hp | Icewall Sso | 10.0 |
| Hp | Icewall Sso Agent Option | 10.0 |
| Openssl | Openssl | 1.0.1 |
| Oracle | Linux | 5 |
| Oracle | Solaris | 10 |
Related Weaknesses (CWE)
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html
- http://rhn.redhat.com/errata/RHSA-2016-1940.html
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://rhn.redhat.com/errata/RHSA-2017-1659.html
FAQ
What is CVE-2016-2177?
CVE-2016-2177 is a vulnerability with a CVSS score of 9.8 (CRITICAL). OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or ...
How severe is CVE-2016-2177?
CVE-2016-2177 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-2177?
Check the references section above for vendor advisories and patch information. Affected products include: Hp Icewall Mcrp, Hp Icewall Sso, Hp Icewall Sso Agent Option, Openssl Openssl, Oracle Linux.