CVE-2016-9939

HIGH

Crypto++ 5.6.4 - Denial of Service via ASN.1 BER Decoding Memory Allocation

Title source: llm

Description

Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.

References (4)

Core 4

Core References

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/12/12/7

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3748

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/94854

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM/

Scores

CVSS v3 7.5

EPSS 0.0420

EPSS Percentile 89.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-20

Status published

Products (2)

cryptopp/crypto\+\+ 5.6.4

debian/debian_linux 8.0

Published Jan 30, 2017

Tracked Since Feb 18, 2026