CVE-2016-0705: Double Free
As per Upstream advisory:
A double free bug was discovered when OpenSSL parses malformed DSA private keys and could lead to a DoS attack or memory corruption for applications that receive DSA private keys from untrusted sources. This scenario is considered rare.
This issue affects OpenSSL versions 1.0.2 and 1.0.1.
OpenSSL 1.0.2 users should upgrade to 1.0.2g OpenSSL 1.0.1 users should upgrade to 1.0.1s
This issue was reported to OpenSSL on 7th February 2016 by Adam Langley (Google/BoringSSL) using libFuzzer. The fix was developed by Dr Stephen Henson of OpenSSL.
Other sources
Double free vulnerability in the dsaprivdecode function in crypto/dsa/dsaameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 1.0.1 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 1.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.3.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.7.1 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 1.0.1s - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 1.0.2g
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-0705?
CVE-2016-0705 has a medium severity rating, allowing for potential denial of service (memory corruption).
How do I fix CVE-2016-0705?
To fix CVE-2016-0705, update OpenSSL to version 1.0.1s or later for 1.0.1 series or 1.0.2g or later for 1.0.2 series.
Which versions of OpenSSL are affected by CVE-2016-0705?
OpenSSL versions 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g are affected by CVE-2016-0705.
Can CVE-2016-0705 lead to data loss?
While CVE-2016-0705 primarily causes denial of service, it may potentially lead to data loss due to memory corruption.
Is CVE-2016-0705 exploitable remotely?
Yes, CVE-2016-0705 can be exploited by remote attackers through a malformed DSA private key.