CVE-2016-2108 Memory corruption in n/a

Critical 9.8 Published 5 May 2016 Updated 5 Aug 2024

Remote attackers can execute arbitrary code or cause denial of service via crafted ASN.1 data in OpenSSL.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-2108?

CVE-2016-2108 is a critical memory corruption vulnerability in Google Android, published on 5 May 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.

Weakness: CWE-119

Which versions are affected by CVE-2016-2108?

It affects 9 products.

Linux distribution packages (10)

`openssl` Red Hat:enterprise_linux:5::client	All versions	`0:0.9.8e-40.el5_11`
`openssl-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:0.9.8e-40.el5_11`
`openssl-perl` Red Hat:enterprise_linux:5::client	All versions	`0:0.9.8e-40.el5_11`
`openssl` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:0.9.8e-40.el5_11`
`openssl-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:0.9.8e-40.el5_11`
`openssl-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:0.9.8e-40.el5_11`
`openssl` Red Hat:enterprise_linux:5::server	All versions	`0:0.9.8e-40.el5_11`
`openssl-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:0.9.8e-40.el5_11`
`openssl-devel` Red Hat:enterprise_linux:5::server	All versions	`0:0.9.8e-40.el5_11`
`openssl-perl` Red Hat:enterprise_linux:5::server	All versions	`0:0.9.8e-40.el5_11`

Products include Google Android, Openssl Openssl, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Hpc Node Eus, Redhat Enterprise Linux Server and 3 more.

How do I fix CVE-2016-2108?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2016-2108 being exploited?

There is no known exploitation of CVE-2016-2108 in the wild and no public exploit code.

All Google Android vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-2108, GHSA-cf8v-cq93-65gh, RHSA-2016:1137, UBUNTU-CVE-2016-2108.