CVE-2016-2177 in OpenSSL
Summary
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Reservation
01/29/2016
Disclosure
06/19/2016
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 91904 | OpenSSL Pointer Arithmetic integer overflow | 190 | Not defined | Official fix | CVE-2016-2177 |
| 88080 | OpenSSL s3_srvr.c integer overflow | 190 | Not defined | Official fix | CVE-2016-2177 |