high
7.5
CWE
190 476
Advisory Published
CVE Published
Updated

CVE-2016-0797: Integer Overflow

First published: Thu Feb 25 2016(Updated: )

As per Upstream advisory: In the BN_hex2bn function the number of hex digits is calculated using an int value |i|. Later |bn_expand| is called with a value of |i * 4|. For large values of |i| this can result in |bn_expand| not allocating any memory because |i * 4| is negative. This can leave the internal BIGNUM data field as NULL leading to a subsequent NULL ptr deref. For very large values of |i|, the calculation |i * 4| could be a positive value smaller than |i|. In this case memory is allocated to the internal BIGNUM data field, but it is insufficiently sized leading to heap corruption. A similar issue exists in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn is ever called by user applications with very large untrusted hex/dec data. This is anticipated to be a rare occurrence. All OpenSSL internal usage of these functions use data that is not expected to be untrusted, e.g. config file data or application command line arguments. If user developed applications generate config file data based on untrusted data then it is possible that this could also lead to security consequences. This is also anticipated to be rare. This issue affects OpenSSL versions 1.0.2 and 1.0.1. OpenSSL 1.0.2 users should upgrade to 1.0.2g OpenSSL 1.0.1 users should upgrade to 1.0.1s This issue was reported to OpenSSL on February 19th 2016 by Guido Vranken. The fix was developed by Matt Caswell of the OpenSSL development team.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
redhat/openssl<1.0.1
1.0.1
redhat/openssl<1.0.2
1.0.2
OpenSSL libcrypto=1.0.1
OpenSSL libcrypto=1.0.1-beta1
OpenSSL libcrypto=1.0.1-beta2
OpenSSL libcrypto=1.0.1-beta3
OpenSSL libcrypto=1.0.1a
OpenSSL libcrypto=1.0.1b
OpenSSL libcrypto=1.0.1c
OpenSSL libcrypto=1.0.1d
OpenSSL libcrypto=1.0.1e
OpenSSL libcrypto=1.0.1f
OpenSSL libcrypto=1.0.1g
OpenSSL libcrypto=1.0.1h
OpenSSL libcrypto=1.0.1i
OpenSSL libcrypto=1.0.1j
OpenSSL libcrypto=1.0.1k
OpenSSL libcrypto=1.0.1l
OpenSSL libcrypto=1.0.1m
OpenSSL libcrypto=1.0.1n
OpenSSL libcrypto=1.0.1o
OpenSSL libcrypto=1.0.1p
OpenSSL libcrypto=1.0.1q
OpenSSL libcrypto=1.0.1r
OpenSSL libcrypto=1.0.2
OpenSSL libcrypto=1.0.2-beta1
OpenSSL libcrypto=1.0.2-beta2
OpenSSL libcrypto=1.0.2-beta3
OpenSSL libcrypto=1.0.2a
OpenSSL libcrypto=1.0.2b
OpenSSL libcrypto=1.0.2c
OpenSSL libcrypto=1.0.2d
OpenSSL libcrypto=1.0.2e
OpenSSL libcrypto=1.0.2f
Node.js>=4.0.0<4.1.2
Node.js>=4.2.0<4.3.2
Node.js>=5.0.0<5.7.1
Ubuntu=12.04
Ubuntu=14.04
Ubuntu=15.10
Debian=7.0
Debian=8.0

Remedy

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Remedy

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2016-0797?

    CVE-2016-0797 has been assigned a severity rating of high due to the potential for denial of service.

  • How do I fix CVE-2016-0797?

    To fix CVE-2016-0797, upgrade your OpenSSL package to version 1.0.1t or 1.0.2d and later.

  • Which versions of OpenSSL are affected by CVE-2016-0797?

    CVE-2016-0797 affects OpenSSL versions 1.0.1 through 1.0.1s and version 1.0.2 through 1.0.2c.

  • What is the impact of CVE-2016-0797?

    The impact of CVE-2016-0797 is that it can lead to denial of service due to memory allocation issues.

  • Is there any workaround for CVE-2016-0797 if I cannot upgrade OpenSSL?

    While the best practice is to upgrade, there are no effective workarounds recommended for CVE-2016-0797.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203