CVE-2016-6303 Integer overflow in n/a
Remote attackers can cause a denial of service via an integer overflow in OpenSSL's MDC2_Update function, leading to application crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6303?
CVE-2016-6303 is a critical vulnerability in Nodejs Node.js, published on 16 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
Weakness: CWE-787
Which versions are affected by CVE-2016-6303?
It affects 2 products.
Products include Nodejs Node.js, Openssl Openssl.
How do I fix CVE-2016-6303?
Upgrade to a fixed version.
Is CVE-2016-6303 being exploited?
There is no known exploitation of CVE-2016-6303 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as ALPINE-CVE-2016-6303, DEBIAN-CVE-2016-6303, GHSA-w6xc-jcff-g3vg, UBUNTU-CVE-2016-6303.