CVE-2016-7052: Null Pointer Dereference
Published Sep 26, 2016
·Updated
crypto/x509/x509vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation.
Affected Software
5 affected components
Novell Suse Linux Enterprise Module For Web Scripting=12.0
OpenSSL OpenSSL=1.0.2i
Nodejs Node.js>=4.0.0<=4.1.2
Nodejs Node.js>=4.2.0<4.6.0
Nodejs Node.js>=6.0.0<6.7.0
Remediation
Event History
Sep 26, 2016
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-7052?
CVE-2016-7052 is classified as a high severity vulnerability due to the potential for denial of service attacks.
2
How do I fix CVE-2016-7052?
To mitigate CVE-2016-7052, it is recommended to upgrade OpenSSL to version 1.0.2j or later.
3
What is the impact of CVE-2016-7052?
CVE-2016-7052 allows remote attackers to exploit a NULL pointer dereference, causing application crashes.
4
Which software is affected by CVE-2016-7052?
CVE-2016-7052 affects OpenSSL version 1.0.2i and certain versions of Node.js and SUSE Linux.
5
Is there a workaround for CVE-2016-7052?
There are no specific workarounds for CVE-2016-7052; upgrading to a patched version is advised.