CVE-2012-2110: Buffer Overflow

Q: What is the severity of CVE-2012-2110?

CVE-2012-2110 has a high severity rating due to its potential for causing buffer overflow attacks, leading to denial of service.

Q: How do I fix CVE-2012-2110?

To fix CVE-2012-2110, update OpenSSL to version 0.9.8v, 1.0.0i, or 1.0.1a or later.

Q: What versions of OpenSSL are affected by CVE-2012-2110?

CVE-2012-2110 affects OpenSSL versions prior to 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a.

Q: What type of vulnerabilities does CVE-2012-2110 represent?

CVE-2012-2110 represents a buffer overflow vulnerability that can lead to memory corruption.

Q: Can CVE-2012-2110 be exploited remotely?

Yes, remote attackers can exploit CVE-2012-2110 to conduct buffer overflow attacks.

Published Apr 19, 2012

Updated

The asn1d2ireadbio function in crypto/asn1/ad2ifp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.

Affected Software

91 affected components

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=1.0.0-beta1

OpenSSL OpenSSL=1.0.0-beta2

OpenSSL OpenSSL=1.0.0-beta3

OpenSSL OpenSSL=1.0.0-beta4

OpenSSL OpenSSL=1.0.0-beta5

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0d

OpenSSL OpenSSL=1.0.0e

OpenSSL OpenSSL=1.0.0g

OpenSSL OpenSSL<=0.9.8u

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.3

OpenSSL OpenSSL=0.9.3a

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.5-beta1

OpenSSL OpenSSL=0.9.5-beta2

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=0.9.5a-beta1

OpenSSL OpenSSL=0.9.5a-beta2

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.6-beta1

OpenSSL OpenSSL=0.9.6-beta2

OpenSSL OpenSSL=0.9.6-beta3

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.6a-beta1

OpenSSL OpenSSL=0.9.6a-beta2

OpenSSL OpenSSL=0.9.6a-beta3

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.7-beta1

OpenSSL OpenSSL=0.9.7-beta2

OpenSSL OpenSSL=0.9.7-beta3

OpenSSL OpenSSL=0.9.7-beta4

OpenSSL OpenSSL=0.9.7-beta5

OpenSSL OpenSSL=0.9.7-beta6

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7f

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL=0.9.7h

OpenSSL OpenSSL=0.9.7i

OpenSSL OpenSSL=0.9.7j

OpenSSL OpenSSL=0.9.7k

OpenSSL OpenSSL=0.9.7l

OpenSSL OpenSSL=0.9.7m

OpenSSL OpenSSL=0.9.8

OpenSSL OpenSSL=0.9.8a

OpenSSL OpenSSL=0.9.8b

OpenSSL OpenSSL=0.9.8c

OpenSSL OpenSSL=0.9.8d

OpenSSL OpenSSL=0.9.8e

OpenSSL OpenSSL=0.9.8f

OpenSSL OpenSSL=0.9.8g

OpenSSL OpenSSL=0.9.8h

OpenSSL OpenSSL=0.9.8i

OpenSSL OpenSSL=0.9.8j

OpenSSL OpenSSL=0.9.8k

OpenSSL OpenSSL=0.9.8l

OpenSSL OpenSSL=0.9.8m

OpenSSL OpenSSL=0.9.8m-beta1

OpenSSL OpenSSL=0.9.8n

OpenSSL OpenSSL=0.9.8o

OpenSSL OpenSSL=0.9.8p

OpenSSL OpenSSL=0.9.8q

OpenSSL OpenSSL=0.9.8r

OpenSSL OpenSSL=0.9.8s

OpenSSL OpenSSL=0.9.8t

redhat Openssl=0.9.6-15

redhat Openssl=0.9.6b-3

redhat Openssl=0.9.7a-2

OpenSSL OpenSSL=1.0.1-beta1

OpenSSL OpenSSL=1.0.1-beta2

Event History

Apr 19, 2012

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2110?

CVE-2012-2110 has a high severity rating due to its potential for causing buffer overflow attacks, leading to denial of service.

How do I fix CVE-2012-2110?

To fix CVE-2012-2110, update OpenSSL to version 0.9.8v, 1.0.0i, or 1.0.1a or later.

What versions of OpenSSL are affected by CVE-2012-2110?