CVE-2016-2106 Integer overflow in n/a
Remote attackers can cause denial of service via heap memory corruption in OpenSSL's encryption function by sending large amounts of data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-2106?
CVE-2016-2106 is a high-severity vulnerability in Openssl Openssl, published on 5 May 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.
Weakness: CWE-189
Which versions are affected by CVE-2016-2106?
It affects 8 products.
Products include Openssl Openssl, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Hpc Node Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus and 2 more.
How do I fix CVE-2016-2106?
Upgrade to a fixed version.
Is CVE-2016-2106 being exploited?
There is no known exploitation of CVE-2016-2106 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as ALPINE-CVE-2016-2106, DEBIAN-CVE-2016-2106, GHSA-j7jq-c44j-q74h, UBUNTU-CVE-2016-2106.