CVE-2016-6304

Опубликовано: 26 сент. 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 7.8

EPSS Средний

Описание

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

Ссылки

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html
Third Party Advisory
VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-1940.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2802.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1415.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1s:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:1.0.1t:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 0.10.0 (включая) до 0.10.47 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 0.12.0 (включая) до 0.12.16 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 4.0.0 (включая) до 4.6.0 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 6.0.0 (включая) до 6.7.0 (исключая)

Конфигурация 5

cpe:2.3:o:novell:suse_linux_enterprise_module_for_web_scripting:12.0:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.20283

Средний

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-401

Связанные уязвимости

CVE-2016-6304

CVSS3: 7.5

ubuntu

больше 8 лет назад

CVE-2016-6304

CVSS3: 7.5

redhat

больше 8 лет назад

CVE-2016-6304

CVSS3: 7.5

debian

больше 8 лет назад

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 befo ...

GHSA-7c6f-r892-6p89

CVSS3: 7.5

github

около 3 лет назад

BDU:2019-01911

CVSS3: 7.5

fstec

почти 9 лет назад

Уязвимость в файле t1_lib.c библиотеки OpenSSL, позволяющие нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 95%

0.20283

Средний

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-401