CVE-2016-9132: Integer Overflow
First published: Mon Jan 30 2017(Updated: )
In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Botan Project Botan | =1.8.0 | |
| Botan Project Botan | =1.8.1 | |
| Botan Project Botan | =1.8.2 | |
| Botan Project Botan | =1.8.3 | |
| Botan Project Botan | =1.8.4 | |
| Botan Project Botan | =1.8.5 | |
| Botan Project Botan | =1.8.6 | |
| Botan Project Botan | =1.8.7 | |
| Botan Project Botan | =1.8.8 | |
| Botan Project Botan | =1.8.9 | |
| Botan Project Botan | =1.8.10 | |
| Botan Project Botan | =1.8.11 | |
| Botan Project Botan | =1.8.12 | |
| Botan Project Botan | =1.8.13 | |
| Botan Project Botan | =1.8.14 | |
| Botan Project Botan | =1.8.15 | |
| Botan Project Botan | =1.9.0 | |
| Botan Project Botan | =1.9.1 | |
| Botan Project Botan | =1.9.2 | |
| Botan Project Botan | =1.9.3 | |
| Botan Project Botan | =1.9.4 | |
| Botan Project Botan | =1.9.5 | |
| Botan Project Botan | =1.9.6 | |
| Botan Project Botan | =1.9.7 | |
| Botan Project Botan | =1.9.8 | |
| Botan Project Botan | =1.9.9 | |
| Botan Project Botan | =1.9.10 | |
| Botan Project Botan | =1.9.11 | |
| Botan Project Botan | =1.9.12 | |
| Botan Project Botan | =1.9.13 | |
| Botan Project Botan | =1.9.14 | |
| Botan Project Botan | =1.9.15 | |
| Botan Project Botan | =1.9.16 | |
| Botan Project Botan | =1.9.17 | |
| Botan Project Botan | =1.9.18 | |
| Botan Project Botan | =1.10.0 | |
| Botan Project Botan | =1.10.1 | |
| Botan Project Botan | =1.10.2 | |
| Botan Project Botan | =1.10.3 | |
| Botan Project Botan | =1.10.4 | |
| Botan Project Botan | =1.10.5 | |
| Botan Project Botan | =1.10.6 | |
| Botan Project Botan | =1.10.7 | |
| Botan Project Botan | =1.10.8 | |
| Botan Project Botan | =1.10.9 | |
| Botan Project Botan | =1.10.10 | |
| Botan Project Botan | =1.10.11 | |
| Botan Project Botan | =1.10.12 | |
| Botan Project Botan | =1.10.13 | |
| Botan Project Botan | =1.10.14 | |
| Botan Project Botan | =1.10.15 | |
| Botan Project Botan | =1.11.0 | |
| Botan Project Botan | =1.11.1 | |
| Botan Project Botan | =1.11.2 | |
| Botan Project Botan | =1.11.3 | |
| Botan Project Botan | =1.11.4 | |
| Botan Project Botan | =1.11.5 | |
| Botan Project Botan | =1.11.6 | |
| Botan Project Botan | =1.11.7 | |
| Botan Project Botan | =1.11.8 | |
| Botan Project Botan | =1.11.9 | |
| Botan Project Botan | =1.11.10 | |
| Botan Project Botan | =1.11.11 | |
| Botan Project Botan | =1.11.12 | |
| Botan Project Botan | =1.11.13 | |
| Botan Project Botan | =1.11.14 | |
| Botan Project Botan | =1.11.15 | |
| Botan Project Botan | =1.11.16 | |
| Botan Project Botan | =1.11.17 | |
| Botan Project Botan | =1.11.18 | |
| Botan Project Botan | =1.11.19 | |
| Botan Project Botan | =1.11.20 | |
| Botan Project Botan | =1.11.21 | |
| Botan Project Botan | =1.11.23 | |
| Botan Project Botan | =1.11.24 | |
| Botan Project Botan | =1.11.25 | |
| Botan Project Botan | =1.11.26 | |
| Botan Project Botan | =1.11.27 | |
| Botan Project Botan | =1.11.28 | |
| Botan Project Botan | =1.11.29 | |
| Botan Project Botan | =1.11.30 | |
| Botan Project Botan | =1.11.31 | |
| Botan Project Botan | =1.11.32 | |
| Botan Project Botan | =1.11.33 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/95879
- https://github.com/randombit/botan/commit/987ad747db6d0d7e36f840398f3cf02e2fbfd90f
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OUDGVRQYQUL7F5MRP3LAV7EHRJG4BBE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2Y3JLMTE3VIV4X5X6SXVZTJBDDLCS3D/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2Y3JLMTE3VIV4X5X6SXVZTJBDDLCS3D/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OUDGVRQYQUL7F5MRP3LAV7EHRJG4BBE/
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/type
- agent/event
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/botan project
- canonical/botan project botan
- version/botan project botan/1.8.0
- version/botan project botan/1.8.1
- version/botan project botan/1.8.2
- version/botan project botan/1.8.3
- version/botan project botan/1.8.4
- version/botan project botan/1.8.5
- version/botan project botan/1.8.6
- version/botan project botan/1.8.7
- version/botan project botan/1.8.8
- version/botan project botan/1.8.9
- version/botan project botan/1.8.10
- version/botan project botan/1.8.11
- version/botan project botan/1.8.12
- version/botan project botan/1.8.13
- version/botan project botan/1.8.14
- version/botan project botan/1.8.15
- version/botan project botan/1.9.0
- version/botan project botan/1.9.1
- version/botan project botan/1.9.2
- version/botan project botan/1.9.3
- version/botan project botan/1.9.4
- version/botan project botan/1.9.5
- version/botan project botan/1.9.6
- version/botan project botan/1.9.7
- version/botan project botan/1.9.8
- version/botan project botan/1.9.9
- version/botan project botan/1.9.10
- version/botan project botan/1.9.11
- version/botan project botan/1.9.12
- version/botan project botan/1.9.13
- version/botan project botan/1.9.14
- version/botan project botan/1.9.15
- version/botan project botan/1.9.16
- version/botan project botan/1.9.17
- version/botan project botan/1.9.18
- version/botan project botan/1.10.0
- version/botan project botan/1.10.1
- version/botan project botan/1.10.2
- version/botan project botan/1.10.3
- version/botan project botan/1.10.4
- version/botan project botan/1.10.5
- version/botan project botan/1.10.6
- version/botan project botan/1.10.7
- version/botan project botan/1.10.8
- version/botan project botan/1.10.9
- version/botan project botan/1.10.10
- version/botan project botan/1.10.11
- version/botan project botan/1.10.12
- version/botan project botan/1.10.13
- version/botan project botan/1.10.14
- version/botan project botan/1.10.15
- version/botan project botan/1.11.0
- version/botan project botan/1.11.1
- version/botan project botan/1.11.2
- version/botan project botan/1.11.3
- version/botan project botan/1.11.4
- version/botan project botan/1.11.5
- version/botan project botan/1.11.6
- version/botan project botan/1.11.7
- version/botan project botan/1.11.8
- version/botan project botan/1.11.9
- version/botan project botan/1.11.10
- version/botan project botan/1.11.11
- version/botan project botan/1.11.12
- version/botan project botan/1.11.13
- version/botan project botan/1.11.14
- version/botan project botan/1.11.15
- version/botan project botan/1.11.16
- version/botan project botan/1.11.17
- version/botan project botan/1.11.18
- version/botan project botan/1.11.19
- version/botan project botan/1.11.20
- version/botan project botan/1.11.21
- version/botan project botan/1.11.23
- version/botan project botan/1.11.24
- version/botan project botan/1.11.25
- version/botan project botan/1.11.26
- version/botan project botan/1.11.27
- version/botan project botan/1.11.28
- version/botan project botan/1.11.29
- version/botan project botan/1.11.30
- version/botan project botan/1.11.31
- version/botan project botan/1.11.32
- version/botan project botan/1.11.33