CVE-2016-7053: CMS Null dereference

Published May 4, 2017

Updated

In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected.

Affected Software

3 affected components

OpenSSL OpenSSL=1.1.0

OpenSSL OpenSSL=1.1.0a

OpenSSL OpenSSL=1.1.0b

Event History

May 4, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-7053?

CVE-2016-7053 has a severity rating of medium due to the potential for application crashes.

How do I fix CVE-2016-7053?

To fix CVE-2016-7053, upgrade your OpenSSL version to 1.1.0c or later.

What types of applications are affected by CVE-2016-7053?

Applications parsing invalid CMS structures in OpenSSL 1.1.0 versions prior to 1.1.0c are affected by CVE-2016-7053.

Can CVE-2016-7053 lead to a denial of service?

Yes, CVE-2016-7053 can lead to a denial of service due to a NULL pointer dereference in affected applications.

Is CVE-2016-7053 a potential security risk?

Yes, CVE-2016-7053 poses a security risk as it can cause unexpected application behavior and crashes.