CVE-2016-2194: Input Validation
Published May 13, 2016
·Updated
The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.
Affected Software
29 affected components
Debian Debian Linux=8.0
Botan Project Botan<=1.10.10
Botan Project Botan=1.11.0
Botan Project Botan=1.11.1
Botan Project Botan=1.11.2
Botan Project Botan=1.11.3
Botan Project Botan=1.11.4
Botan Project Botan=1.11.5
Botan Project Botan=1.11.6
Botan Project Botan=1.11.7
Botan Project Botan=1.11.8
Botan Project Botan=1.11.9
Botan Project Botan=1.11.10
Botan Project Botan=1.11.11
Botan Project Botan=1.11.12
Botan Project Botan=1.11.13
Botan Project Botan=1.11.14
Botan Project Botan=1.11.15
Botan Project Botan=1.11.16
Botan Project Botan=1.11.17
Botan Project Botan=1.11.18
Botan Project Botan=1.11.19
Botan Project Botan=1.11.20
Botan Project Botan=1.11.21
Botan Project Botan=1.11.22
Botan Project Botan=1.11.23
Botan Project Botan=1.11.24
Botan Project Botan=1.11.25
Botan Project Botan=1.11.26
Event History
May 13, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2194?
CVE-2016-2194 has a severity rating that allows remote attackers to cause a denial of service through an infinite loop.
2
How do I fix CVE-2016-2194?
To fix CVE-2016-2194, you should upgrade to Botan versions 1.10.11 or 1.11.27 or later.
3
What versions of Botan are affected by CVE-2016-2194?
CVE-2016-2194 affects Botan versions prior to 1.10.11 and 1.11.x before 1.11.27.
4
Is CVE-2016-2194 specific to any operating systems?
CVE-2016-2194 is noted to affect Debian Linux 8.0 and various versions of the Botan library.
5
Can CVE-2016-2194 be exploited remotely?
Yes, CVE-2016-2194 can be exploited remotely by sending unspecified input to the OS2ECP function.