CVE-2016-6303: openssl 1.0.2h vulnerabilities
An overflow can occur in MDC2Update() under certain circumstances resulting in an out of bounds (OOB) error. This attack is impractical on most platforms due to the size of data required to trigger the OOB error.
Node.js is impacted by this flaw but due to the impracticalities of exploiting it and the very low usage of of MDC-2, it is very low severity for Node.js users.
Other sources
Integer overflow in the MDC2Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
— Launchpad
Possible integer overflow vulnerability was found in MDC2Update() function that can lead to out-of-bounds write.
Upstream patch:
https://github.com/openssl/openssl/commit/2b4029e68fd7002d2307e6c3cde0f3784eef9c83
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u2Fixed in 3.0.15-1~deb12u1Fixed in 3.0.14-1~deb12u2Fixed in 3.5.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.0Fixed in 6.7.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.0 - Upgrade
Upgrade
opensslto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-6303?
CVE-2016-6303 has a high severity, causing potential denial of service and application crashes.
How do I fix CVE-2016-6303?
To fix CVE-2016-6303, update OpenSSL to version 1.1.0 or later.
What is the impact of exploiting CVE-2016-6303?
Exploiting CVE-2016-6303 can lead to out-of-bounds writes and application crashes.
Which versions of OpenSSL are affected by CVE-2016-6303?
All versions of OpenSSL prior to 1.1.0 are affected by CVE-2016-6303.
Can CVE-2016-6303 affect Node.js applications?
Yes, CVE-2016-6303 can impact Node.js applications using affected versions of OpenSSL.