CVE-2016-9132: Integer Overflow
Published Jan 30, 2017
·Updated
In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.
Affected Software
84 affected components
Botan Project Botan=1.8.0
Botan Project Botan=1.8.1
Botan Project Botan=1.8.2
Botan Project Botan=1.8.3
Botan Project Botan=1.8.4
Botan Project Botan=1.8.5
Botan Project Botan=1.8.6
Botan Project Botan=1.8.7
Botan Project Botan=1.8.8
Botan Project Botan=1.8.9
Botan Project Botan=1.8.10
Botan Project Botan=1.8.11
Botan Project Botan=1.8.12
Botan Project Botan=1.8.13
Botan Project Botan=1.8.14
Botan Project Botan=1.8.15
Botan Project Botan=1.9.0
Botan Project Botan=1.9.1
Botan Project Botan=1.9.2
Botan Project Botan=1.9.3
Botan Project Botan=1.9.4
Botan Project Botan=1.9.5
Botan Project Botan=1.9.6
Botan Project Botan=1.9.7
Botan Project Botan=1.9.8
Botan Project Botan=1.9.9
Botan Project Botan=1.9.10
Botan Project Botan=1.9.11
Botan Project Botan=1.9.12
Botan Project Botan=1.9.13
Botan Project Botan=1.9.14
Botan Project Botan=1.9.15
Botan Project Botan=1.9.16
Botan Project Botan=1.9.17
Botan Project Botan=1.9.18
Botan Project Botan=1.10.0
Botan Project Botan=1.10.1
Botan Project Botan=1.10.2
Botan Project Botan=1.10.3
Botan Project Botan=1.10.4
Botan Project Botan=1.10.5
Botan Project Botan=1.10.6
Botan Project Botan=1.10.7
Botan Project Botan=1.10.8
Botan Project Botan=1.10.9
Botan Project Botan=1.10.10
Botan Project Botan=1.10.11
Botan Project Botan=1.10.12
Botan Project Botan=1.10.13
Botan Project Botan=1.10.14
Botan Project Botan=1.10.15
Botan Project Botan=1.11.0
Botan Project Botan=1.11.1
Botan Project Botan=1.11.2
Botan Project Botan=1.11.3
Botan Project Botan=1.11.4
Botan Project Botan=1.11.5
Botan Project Botan=1.11.6
Botan Project Botan=1.11.7
Botan Project Botan=1.11.8
Botan Project Botan=1.11.9
Botan Project Botan=1.11.10
Botan Project Botan=1.11.11
Botan Project Botan=1.11.12
Botan Project Botan=1.11.13
Botan Project Botan=1.11.14
Botan Project Botan=1.11.15
Botan Project Botan=1.11.16
Botan Project Botan=1.11.17
Botan Project Botan=1.11.18
Botan Project Botan=1.11.19
Botan Project Botan=1.11.20
Botan Project Botan=1.11.21
Botan Project Botan=1.11.23
Botan Project Botan=1.11.24
Botan Project Botan=1.11.25
Botan Project Botan=1.11.26
Botan Project Botan=1.11.27
Botan Project Botan=1.11.28
Botan Project Botan=1.11.29
Botan Project Botan=1.11.30
Botan Project Botan=1.11.31
Botan Project Botan=1.11.32
Botan Project Botan=1.11.33
Remediation
Event History
Jan 30, 2017
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Data Sourced
via NVD·10:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-9132?
CVE-2016-9132 has a severity rating of medium due to the potential for memory corruption.
2
How do I fix CVE-2016-9132?
To fix CVE-2016-9132, update Botan to version 1.11.34 or later.
3
Which versions of Botan are affected by CVE-2016-9132?
CVE-2016-9132 affects Botan versions 1.8.0 through 1.11.33.
4
What types of security issues does CVE-2016-9132 cause?
CVE-2016-9132 can lead to incorrect length field calculation, memory corruption, or crashes.
5
Is CVE-2016-9132 a remote exploit?
CVE-2016-9132 may be exploited remotely if an attacker can manipulate BER data processed by the application.