crítica
CVE-2016-2182
openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec()
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.2CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Oracle (alta), Red Hat (media), Amazon (media), Ubuntu (baja).
Descripción
The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.2 | openssl | 1.0.2h-r3 |
| alpine 3.3 | openssl | 1.0.2h-r3 |
| alpine 3.4 | openssl | 1.0.2h-r3 |
| alpine 3.5 | openssl | 1.0.2h-r3 |
| alpine 3.6 | openssl | 1.0.2h-r3 |
| alpine 3.7 | openssl | 1.0.2h-r3 |
| alpine 3.8 | openssl | 1.0.2h-r3 |
| amazon linux 1 | openssl, openssl-debuginfo, openssl-devel y 2 más | 1:1.0.1k-15.96.amzn1 |
| debian 11 | openssl | 1.0.2i-1 |
| debian 12 | openssl | 1.0.2i-1 |
| debian 13 | openssl | 1.0.2i-1 |
| debian 14 | openssl | 1.0.2i-1 |
Mostrar las 48 entradas de 34 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.2 | openssl | 1.0.2h-r3 |
| alpine 3.3 | openssl | 1.0.2h-r3 |
| alpine 3.4 | openssl | 1.0.2h-r3 |
| alpine 3.5 | openssl | 1.0.2h-r3 |
| alpine 3.6 | openssl | 1.0.2h-r3 |
| alpine 3.7 | openssl | 1.0.2h-r3 |
| alpine 3.8 | openssl | 1.0.2h-r3 |
| amazon linux 1 | openssl | 1:1.0.1k-15.96.amzn1 |
| amazon linux 1 | openssl-debuginfo | 1:1.0.1k-15.96.amzn1 |
| amazon linux 1 | openssl-devel | 1:1.0.1k-15.96.amzn1 |
| amazon linux 1 | openssl-perl | 1:1.0.1k-15.96.amzn1 |
| amazon linux 1 | openssl-static | 1:1.0.1k-15.96.amzn1 |
| debian 11 | openssl | 1.0.2i-1 |
| debian 12 | openssl | 1.0.2i-1 |
| debian 13 | openssl | 1.0.2i-1 |
| debian 14 | openssl | 1.0.2i-1 |
| debian 7 | openssl | 1.0.1t-1+deb7u1 |
| debian 8 | openssl | 1.0.1t-1+deb8u4 |
| echo | openssl | 1.0.2i-1 |
| Oracle Linux 5 | openssl | 0.9.8e-40.0.3.el5_11 |
| Oracle Linux 5 | openssl-devel | 0.9.8e-40.0.3.el5_11 |
| Oracle Linux 5 | openssl-perl | 0.9.8e-40.0.3.el5_11 |
| Oracle Linux 6 | openssl | 1.0.1e-48.el6_8.3 |
| Oracle Linux 6 | openssl-devel | 1.0.1e-48.el6_8.3 |
| Oracle Linux 6 | openssl-perl | 1.0.1e-48.el6_8.3 |
| Oracle Linux 6 | openssl-static | 1.0.1e-48.el6_8.3 |
| Oracle Linux 7 | openssl | 1:1.0.1e-51.el7_2.7 |
| Oracle Linux 7 | openssl-devel | 1:1.0.1e-51.el7_2.7 |
| Oracle Linux 7 | openssl-libs | 1:1.0.1e-51.el7_2.7 |
| Oracle Linux 7 | openssl-perl | 1:1.0.1e-51.el7_2.7 |
| Oracle Linux 7 | openssl-static | 1:1.0.1e-51.el7_2.7 |
| Red Hat | openssl098e | sin corrección indicada |
| root.io debian 11 | rootio-openssl | 1.0.2i-1 |
| root.io debian 12 | rootio-openssl | 1.0.2i-1 |
| seal Red Hat 6 | openssl | 1.0.1e-59.el6_10+sp999, 1.0.1e-61.el6_10+sp999 |
| seal Red Hat 6 | seal-openssl | 1.0.1e-59.el6_10+sp999, 1.0.1e-61.el6_10+sp999 |
| ubuntu 12.04 | openssl | 1.0.1-4ubuntu5.37 |
| ubuntu 14.04 | openssl | 1.0.1f-1ubuntu2.20 |
| ubuntu 14.04-ESM | openssl | 1.0.1f-1ubuntu2.20 |
| ubuntu 16.04 | openssl | 1.0.2g-1ubuntu4.4 |
| ubuntu 16.04-ESM | openssl | 1.0.2g-1ubuntu4.4 |
| ubuntu 16.10 | openssl | 1.0.2g-1ubuntu9 |
| ubuntu 17.04 | openssl | 1.0.2g-1ubuntu9 |
| ubuntu 17.10 | openssl | 1.0.2g-1ubuntu9 |
| ubuntu 18.04 | openssl | 1.0.2g-1ubuntu9 |
| ubuntu 18.04-ESM | openssl | 1.0.2g-1ubuntu9 |
| ubuntu 18.10 | openssl | 1.0.2g-1ubuntu9 |
| ubuntu 19.04 | openssl | 1.0.2g-1ubuntu9 |
Referencias
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html
Las 60 referencias
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html
- http://rhn.redhat.com/errata/RHSA-2016-1940.html
- http://seclists.org/fulldisclosure/2017/Jul/31
- http://www-01.ibm.com/support/docview.wss?uid=swg21995039
- http://www.debian.org/security/2016/dsa-3673
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
- http://www.securityfocus.com/bid/92557
- http://www.securitytracker.com/id/1036688
- http://www.securitytracker.com/id/1037968
- http://www.splunk.com/view/SP-CAAAPSV
- http://www.splunk.com/view/SP-CAAAPUE
- http://www.ubuntu.com/usn/USN-3087-1
- http://www.ubuntu.com/usn/USN-3087-2
- https://access.redhat.com/errata/RHSA-2018:2185
- https://access.redhat.com/errata/RHSA-2018:2186
- https://access.redhat.com/errata/RHSA-2018:2187
- https://access.redhat.com/security/cve/CVE-2016-2182
- https://bto.bluecoat.com/security-advisory/sa132
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
- https://kc.mcafee.com/corporate/index?page=content&id=SB10171
- https://kc.mcafee.com/corporate/index?page=content&id=SB10215
- https://linux.oracle.com/cve/CVE-2016-2182.html
- https://linux.oracle.com/errata/ELSA-2016-3627.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-2182
- https://security.freebsd.org/advisories/FreeBSD-SA-16:26.openssl.asc
- https://source.android.com/security/bulletin/2017-03-01
- https://source.android.com/security/bulletin/2017-03-01.html
- https://support.f5.com/csp/article/K01276005
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us
- https://ubuntu.com/security/notices/USN-3087-1
- https://ubuntu.com/security/notices/USN-3087-2
- https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24
- https://www.cve.org/CVERecord?id=CVE-2016-2182
- https://www.openssl.org/news/secadv/20160922.txt
- https://www.tenable.com/security/tns-2016-16
- https://www.tenable.com/security/tns-2016-20
- https://www.tenable.com/security/tns-2016-21