Vulnerability Description
The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hp | Icewall Federation Agent | 3.0 |
| Hp | Icewall Mcrp | 3.0 |
| Hp | Icewall Sso | 10.0 |
| Hp | Icewall Sso Agent Option | 10.0 |
| Openssl | Openssl | 1.0.1 |
| Oracle | Linux | 5 |
Related Weaknesses (CWE)
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html
- http://rhn.redhat.com/errata/RHSA-2016-1940.html
- http://seclists.org/fulldisclosure/2017/Jul/31
- http://www-01.ibm.com/support/docview.wss?uid=swg21995039Third Party Advisory
FAQ
What is CVE-2016-2182?
CVE-2016-2182 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and ...
How severe is CVE-2016-2182?
CVE-2016-2182 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-2182?
Check the references section above for vendor advisories and patch information. Affected products include: Hp Icewall Federation Agent, Hp Icewall Mcrp, Hp Icewall Sso, Hp Icewall Sso Agent Option, Openssl Openssl.