CVE-2016-6303: Integer Overflow
Integer overflow in the MDC2Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
Other sources
Possible integer overflow vulnerability was found in MDC2Update() function that can lead to out-of-bounds write.
Upstream patch:
https://github.com/openssl/openssl/commit/2b4029e68fd7002d2307e6c3cde0f3784eef9c83
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6303?
CVE-2016-6303 has a high severity, causing potential denial of service and application crashes.
How do I fix CVE-2016-6303?
To fix CVE-2016-6303, update OpenSSL to version 1.1.0 or later.
What is the impact of exploiting CVE-2016-6303?
Exploiting CVE-2016-6303 can lead to out-of-bounds writes and application crashes.
Which versions of OpenSSL are affected by CVE-2016-6303?
All versions of OpenSSL prior to 1.1.0 are affected by CVE-2016-6303.
Can CVE-2016-6303 affect Node.js applications?
Yes, CVE-2016-6303 can impact Node.js applications using affected versions of OpenSSL.