Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2016-6303: OpenSSL versions before 1.1.0 may crash from crafted input
CVE-2016-6303 · published 10 years ago
Summary
The cryptographic library OpenSSL (versions older than 1.1.0) can mishandle certain data, causing a counting error that writes outside its memory space. This can make the program stop working or become unstable when an attacker sends specially crafted information. Upgrade OpenSSL to version 1.1.0 or later, or apply the vendor’s security patch, to prevent the issue.
What to do
- Update openssl to version 1.0.2h-r3.
- Update debian openssl to version 1.0.2i-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Alpine:v3.2 | – | openssl |
< 1.0.2h-r3 Fix: upgrade to 1.0.2h-r3
|
| Debian:12 | debian | openssl |
< 1.0.2i-1 Fix: upgrade to 1.0.2i-1
|
| Debian:13 | debian | openssl |
< 1.0.2i-1 Fix: upgrade to 1.0.2i-1
|
| Debian:14 | debian | openssl |
< 1.0.2i-1 Fix: upgrade to 1.0.2i-1
|
| – | nodejs | node.js |
< 0.12.16 >= 4.0.0, < 4.6.0 >= 6.0.0, < 6.6.0 cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* |
| – | openssl | openssl |
1.0.1 1.0.1a 1.0.1b 1.0.1c 1.0.1d 1.0.1e 1.0.1f 1.0.1g 1.0.1h 1.0.1i 1.0.1j 1.0.1k 18 more version ranges
cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:* |
Original advisory text
Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or po...
Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
References
- https://security-tracker.debian.org/tracker/CVE-2016-6303 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2016-6303 Vendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21995039 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Patch Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html Patch Third Party Advisory
- http://www.securityfocus.com/bid/92984 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1036885 Third Party Advisory VDB Entry
- https://bto.bluecoat.com/security-advisory/sa132 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1370146 Issue Tracking Patch Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=55d83bf7c10c7b205fffa23fa7...
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312 Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc Third Party Advisory
- https://www.tenable.com/security/tns-2016-16 Third Party Advisory
- https://www.tenable.com/security/tns-2016-20 Third Party Advisory
- https://www.tenable.com/security/tns-2016-21 Third Party Advisory
Severity
9.8
Critical
Type
CWE-787Out-of-bounds Write
Timeline
Published16 Sep 2016
Updated29 Sep 2026
First seen22 Sep 2026
Track software like this
Free during beta