kritik
CVE-2016-2108
openssl: Memory corruption in the ASN.1 encoder
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), Amazon (yüksek), Oracle (yüksek), Ubuntu (yüksek).
Açıklama
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | openssl, openssl-debuginfo, openssl-devel ve 2 tane daha | 1:1.0.1k-14.91.amzn1 |
| debian 11 | openssl | 1.0.2c-1 |
| debian 12 | openssl | 1.0.2c-1 |
| debian 13 | openssl | 1.0.2c-1 |
| debian 14 | openssl | 1.0.2c-1 |
| debian 7 | openssl | 1.0.1e-2+deb7u21 |
| debian 8 | openssl | 1.0.1k-3+deb8u5 |
| echo | openssl | 1.0.2c-1 |
| Oracle Linux 5 | openssl, openssl-devel, openssl-perl | 0.9.8e-40.0.1.el5_11 |
| Oracle Linux 6 | openssl, openssl-devel, openssl-fips ve 5 tane daha | 1.0.1e-48.el6_8.1 ve 1 tane daha |
| Oracle Linux 7 | openssl, openssl-devel, openssl-libs ve 2 tane daha | 1:1.0.1e-51.el7_2.5 |
| Red Hat | openssl098e | düzeltme belirtilmemiş |
28 kaynaktaki 46 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | openssl | 1:1.0.1k-14.91.amzn1 |
| amazon linux 1 | openssl-debuginfo | 1:1.0.1k-14.91.amzn1 |
| amazon linux 1 | openssl-devel | 1:1.0.1k-14.91.amzn1 |
| amazon linux 1 | openssl-perl | 1:1.0.1k-14.91.amzn1 |
| amazon linux 1 | openssl-static | 1:1.0.1k-14.91.amzn1 |
| debian 11 | openssl | 1.0.2c-1 |
| debian 12 | openssl | 1.0.2c-1 |
| debian 13 | openssl | 1.0.2c-1 |
| debian 14 | openssl | 1.0.2c-1 |
| debian 7 | openssl | 1.0.1e-2+deb7u21 |
| debian 8 | openssl | 1.0.1k-3+deb8u5 |
| echo | openssl | 1.0.2c-1 |
| Oracle Linux 5 | openssl | 0.9.8e-40.0.1.el5_11 |
| Oracle Linux 5 | openssl-devel | 0.9.8e-40.0.1.el5_11 |
| Oracle Linux 5 | openssl-perl | 0.9.8e-40.0.1.el5_11 |
| Oracle Linux 6 | openssl | 1.0.1e-48.el6_8.1 |
| Oracle Linux 6 | openssl-devel | 1.0.1e-48.el6_8.1 |
| Oracle Linux 6 | openssl-fips | 1.0.1t-2.0.1.el6 |
| Oracle Linux 6 | openssl-fips-devel | 1.0.1t-2.0.1.el6 |
| Oracle Linux 6 | openssl-fips-perl | 1.0.1t-2.0.1.el6 |
| Oracle Linux 6 | openssl-fips-static | 1.0.1t-2.0.1.el6 |
| Oracle Linux 6 | openssl-perl | 1.0.1e-48.el6_8.1 |
| Oracle Linux 6 | openssl-static | 1.0.1e-48.el6_8.1 |
| Oracle Linux 7 | openssl | 1:1.0.1e-51.el7_2.5 |
| Oracle Linux 7 | openssl-devel | 1:1.0.1e-51.el7_2.5 |
| Oracle Linux 7 | openssl-libs | 1:1.0.1e-51.el7_2.5 |
| Oracle Linux 7 | openssl-perl | 1:1.0.1e-51.el7_2.5 |
| Oracle Linux 7 | openssl-static | 1:1.0.1e-51.el7_2.5 |
| Red Hat | openssl098e | düzeltme belirtilmemiş |
| root.io debian 11 | rootio-openssl | 1.0.2c-1 |
| root.io debian 12 | rootio-openssl | 1.0.2c-1 |
| seal Red Hat 6 | openssl | 1.0.1e-59.el6_10+sp999, 1.0.1e-61.el6_10+sp999 |
| seal Red Hat 6 | seal-openssl | 1.0.1e-59.el6_10+sp999, 1.0.1e-61.el6_10+sp999 |
| ubuntu 12.04 | openssl | 1.0.1-4ubuntu5.36 |
| ubuntu 14.04 | openssl | 1.0.1f-1ubuntu2.19 |
| ubuntu 14.04-ESM | openssl | 1.0.1f-1ubuntu2.19 |
| ubuntu 15.10 | openssl | 1.0.2d-0ubuntu1.5 |
| ubuntu 16.04 | openssl | 1.0.2g-1ubuntu4.1 |
| ubuntu 16.04-ESM | openssl | 1.0.2g-1ubuntu4.1 |
| ubuntu 16.10 | openssl | 1.0.2g-1ubuntu5 |
| ubuntu 17.04 | openssl | 1.0.2g-1ubuntu5 |
| ubuntu 17.10 | openssl | 1.0.2g-1ubuntu5 |
| ubuntu 18.04 | openssl | 1.0.2g-1ubuntu5 |
| ubuntu 18.04-ESM | openssl | 1.0.2g-1ubuntu5 |
| ubuntu 18.10 | openssl | 1.0.2g-1ubuntu5 |
| ubuntu 19.04 | openssl | 1.0.2g-1ubuntu5 |
Referanslar
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html
66 referansın hepsi
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html
- http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html
- http://rhn.redhat.com/errata/RHSA-2016-0722.html
- http://rhn.redhat.com/errata/RHSA-2016-0996.html
- http://rhn.redhat.com/errata/RHSA-2016-2056.html
- http://rhn.redhat.com/errata/RHSA-2016-2073.html
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://source.android.com/security/bulletin/2016-07-01.html
- http://support.citrix.com/article/CTX212736
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl
- http://www.debian.org/security/2016/dsa-3566
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/89752
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1035721
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103
- http://www.ubuntu.com/usn/USN-2959-1
- https://access.redhat.com/errata/RHSA-2016:1137
- https://access.redhat.com/errata/RHSA-2017:0193
- https://access.redhat.com/errata/RHSA-2017:0194
- https://access.redhat.com/security/cve/CVE-2016-2108
- https://bto.bluecoat.com/security-advisory/sa123
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3661bb4e7934668bd99ca777ea8b30eedfafa871
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
- https://linux.oracle.com/cve/CVE-2016-2108.html
- https://linux.oracle.com/errata/ELSA-2016-3571.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-2108
- https://openssl.org/news/secadv/20160503.txt
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067&languageid=en-fr
- https://security.gentoo.org/glsa/201612-16
- https://security.netapp.com/advisory/ntap-20160504-0001/
- https://support.apple.com/HT206903
- https://ubuntu.com/security/notices/USN-2959-1
- https://www.cve.org/CVERecord?id=CVE-2016-2108
- https://www.openssl.org/news/secadv/20160503.txt
- https://www.tenable.com/security/tns-2016-18