CVE-2016-6878

CRITICAL

Botan < 1.11.30 - Undefined Behavior in Curve25519 on 32-bit ARM

Title source: llm
STIX 2.1

Description

The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified impact via vectors related to undefined behavior, as demonstrated on 32-bit ARM systems compiled by Clang.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_confirm
https://botan.randombit.net/security.html#id2

Scores

CVSS v3 9.8
EPSS 0.0123
EPSS Percentile 65.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (1)
botan_project/botan < 1.11.30
Published Apr 10, 2017
Tracked Since Feb 18, 2026