Integer Overflow or Wraparound Affecting openssl-libs package, versions <1:1.0.1e-51.el7_2.5
Snyk CVSS
Attack Complexity
High
Threat Intelligence
EPSS
32.8% (97th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS7-OPENSSLLIBS-2065273
- published 26 Jul 2021
- disclosed 3 May 2016
How to fix?
Upgrade Centos:7
openssl-libs
to version 1:1.0.1e-51.el7_2.5 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssl-libs
package and not the openssl-libs
package as distributed by Centos
.
See How to fix?
for Centos:7
relevant fixed versions and status.
Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.
References
- APPLE
- BID
- BID
- CISCO
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CONFIRM
- CVE-2016-2106
- DEBIAN
- FEDORA
- FEDORA
- FEDORA
- FREEBSD
- GENTOO
- MISC
- REDHAT
- REDHAT
- REDHAT
- REDHAT
- REDHAT
- REDHAT
- REDHAT
- REDHAT
- RHSA-2016:0722
- SECTRACK
- SLACKWARE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- SUSE
- UBUNTU
- secalert@redhat.com
- secalert@redhat.com