CVE Feed

Dashboard / CVE / CVE-2016-2182

CVE-2016-2182

The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

Published:Aug 16, 2016

Last Modified:Apr 12, 2025

EPS:Sep 16, 2016

EPSS Score:0.50929

CVSS Score:9.8

Affected Products

Vendor

Product

Action

Vendor

Hp

Product

Icewall Federation Agent

Hp

Icewall Federation Agent

Vendor

Hp

Product

Icewall Mcrp

Hp

Icewall Mcrp

Vendor

Hp

Product

Icewall Sso

Hp

Icewall Sso

Vendor

Hp

Product

Icewall Sso Agent Option

Hp

Icewall Sso Agent Option

Vendor

Openssl

Product

Openssl

Openssl

Openssl

Vendor

Oracle

Product

Linux

Oracle

Linux

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Jboss Core Services

Redhat

Jboss Core Services

Exploits

No exploit reference

Common Weakness Enumeration

CWE-391 Unchecked Error Condition

CWE-787 Out-of-bounds Write

Common Attack Pattern Enumeration and Classification (CAPEC)

No CAPEC recorded yet

Related CVEs

CVE-2017-8945 (CVSS 6.1) — A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Federation Agent version 3.0 was …

CVE-2016-6306 (CVSS 5.9) — The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause …

CVE-2016-4447 (CVSS 7.5) — The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cau…

CVE-2016-4448 (CVSS 9.8) — Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format str…

CVE-2016-3705 (CVSS 7.5) — The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not pro…

CVE-2016-9597 (CVSS 7.5) — It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually includ…

CVE-2016-3627 (CVSS 7.5) — The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows c…

CVE-2015-7497 (CVSS 5) — Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows con…

CVE-2015-7499 (CVSS 5) — Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependen…

CVE-2015-7500 (CVSS 5) — The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a de…

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

http://rhn.redhat.com/errata/RHSA-2016-1940.html

http://seclists.org/fulldisclosure/2017/Jul/31

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

http://www.debian.org/security/2016/dsa-3673

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

http://www.securityfocus.com/bid/92557

http://www.securitytracker.com/id/1036688

http://www.securitytracker.com/id/1037968

http://www.splunk.com/view/SP-CAAAPSV

http://www.splunk.com/view/SP-CAAAPUE

http://www.ubuntu.com/usn/USN-3087-1

http://www.ubuntu.com/usn/USN-3087-2

https://access.redhat.com/errata/RHSA-2018:2185

https://access.redhat.com/errata/RHSA-2018:2186

https://access.redhat.com/errata/RHSA-2018:2187

https://bto.bluecoat.com/security-advisory/sa132

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

https://kc.mcafee.com/corporate/index?page=content&id=SB10171

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

https://source.android.com/security/bulletin/2017-03-01

https://source.android.com/security/bulletin/2017-03-01.html

https://support.f5.com/csp/article/K01276005

https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

https://www.tenable.com/security/tns-2016-16

https://www.tenable.com/security/tns-2016-20

https://www.tenable.com/security/tns-2016-21

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

http://rhn.redhat.com/errata/RHSA-2016-1940.html

http://seclists.org/fulldisclosure/2017/Jul/31

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

http://www.debian.org/security/2016/dsa-3673

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

http://www.securityfocus.com/bid/92557

http://www.securitytracker.com/id/1036688

http://www.securitytracker.com/id/1037968

http://www.splunk.com/view/SP-CAAAPSV

http://www.splunk.com/view/SP-CAAAPUE

http://www.ubuntu.com/usn/USN-3087-1

http://www.ubuntu.com/usn/USN-3087-2

https://access.redhat.com/errata/RHSA-2018:2185

https://access.redhat.com/errata/RHSA-2018:2186

https://access.redhat.com/errata/RHSA-2018:2187

https://bto.bluecoat.com/security-advisory/sa132

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

https://kc.mcafee.com/corporate/index?page=content&id=SB10171

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

https://source.android.com/security/bulletin/2017-03-01

https://source.android.com/security/bulletin/2017-03-01.html

https://support.f5.com/csp/article/K01276005

https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

https://www.tenable.com/security/tns-2016-16

https://www.tenable.com/security/tns-2016-20

https://www.tenable.com/security/tns-2016-21

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High