CVE-2016-9939: Input Validation
Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9939?
CVE-2016-9939 is classified as a medium severity vulnerability due to its potential impact on memory allocation leading to possible application crashes.
How do I fix CVE-2016-9939?
To mitigate CVE-2016-9939, upgrade to a fixed version of Crypto++ that addresses the vulnerability.
Which versions are affected by CVE-2016-9939?
CVE-2016-9939 specifically affects Crypto++ version 5.6.4.
Can CVE-2016-9939 lead to denial of service?
Yes, CVE-2016-9939 can potentially lead to denial of service if exploited through improper ASN.1 decoding.
How does CVE-2016-9939 impact applications using Crypto++?
CVE-2016-9939 can cause applications relying on Crypto++ version 5.6.4 to crash due to improper memory handling.