CVE-2016-2195: Buffer Overflow
Published May 13, 2016
·Updated
Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow.
Affected Software
29 affected components
Botan Project Botan<=1.10.10
Botan Project Botan=1.11.0
Botan Project Botan=1.11.1
Botan Project Botan=1.11.2
Botan Project Botan=1.11.3
Botan Project Botan=1.11.4
Botan Project Botan=1.11.5
Botan Project Botan=1.11.6
Botan Project Botan=1.11.7
Botan Project Botan=1.11.8
Botan Project Botan=1.11.9
Botan Project Botan=1.11.10
Botan Project Botan=1.11.11
Botan Project Botan=1.11.12
Botan Project Botan=1.11.13
Botan Project Botan=1.11.14
Botan Project Botan=1.11.15
Botan Project Botan=1.11.16
Botan Project Botan=1.11.17
Botan Project Botan=1.11.18
Botan Project Botan=1.11.19
Botan Project Botan=1.11.20
Botan Project Botan=1.11.21
Botan Project Botan=1.11.22
Botan Project Botan=1.11.23
Botan Project Botan=1.11.24
Botan Project Botan=1.11.25
Botan Project Botan=1.11.26
Debian Debian Linux=8.0
Event History
May 13, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2195?
The severity of CVE-2016-2195 is classified as high due to the potential for remote code execution.
2
How do I fix CVE-2016-2195?
To fix CVE-2016-2195, update Botan to version 1.10.11 or 1.11.27 or later.
3
What versions of Botan are affected by CVE-2016-2195?
Botan versions before 1.10.11 and 1.11.x before 1.11.27 are affected by CVE-2016-2195.
4
What type of vulnerability is CVE-2016-2195?
CVE-2016-2195 is an integer overflow vulnerability that can lead to a heap-based buffer overflow.
5
Can CVE-2016-2195 be exploited remotely?
Yes, CVE-2016-2195 can be exploited remotely through crafted ECC points.