CVE-2016-2176: Buffer Overflow
The X509NAMEoneline function in crypto/x509/x509obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2176?
CVE-2016-2176 is considered a moderate severity vulnerability that can lead to information leakage or denial of service.
How do I fix CVE-2016-2176?
To mitigate CVE-2016-2176, upgrade to OpenSSL version 1.0.1t or later for the 1.0.1 branch, and to 1.0.2h or later for the 1.0.2 branch.
What types of attacks are possible with CVE-2016-2176?
An attacker can exploit CVE-2016-2176 to perform a buffer over-read, potentially revealing sensitive information from the process stack.
Which versions of OpenSSL are affected by CVE-2016-2176?
CVE-2016-2176 affects OpenSSL versions before 1.0.1t and the entire 1.0.2 branch prior to 1.0.2h.
Is CVE-2016-2176 a remote vulnerability?
Yes, CVE-2016-2176 can be exploited by remote attackers through specially crafted EBCDIC ASN.1 data.