CVE-2016-2177

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssl	19.04 disco	Fixed 1.0.2g-1ubuntu9
	18.10 cosmic	Fixed 1.0.2g-1ubuntu9
	18.04 LTS bionic	Fixed 1.0.2g-1ubuntu9
	17.10 artful	Fixed 1.0.2g-1ubuntu9
	17.04 zesty	Fixed 1.0.2g-1ubuntu9
	16.10 yakkety	Fixed 1.0.2g-1ubuntu9
	16.04 LTS xenial	Fixed 1.0.2g-1ubuntu4.4
	15.10 wily	Ignored end of life
	14.04 LTS trusty	Fixed 1.0.1f-1ubuntu2.22
	12.04 LTS precise	Fixed 1.0.1-4ubuntu5.39
openssl098	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	15.10 wily	Not in release
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Ignored end of life

Notes

mdeslaur

USN-3087-1 fixed this CVE in Ubuntu 16.04 LTS. Other Ubuntu releases will be fixed in a future USN.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openssl	Upstream: https://git.openssl.org/?p=openssl.git;a=commit;h=a004e72b95835136d3f1ea90517f706c24c03da7 Upstream: https://git.openssl.org/?p=openssl.git;a=commit;h=89c2720298f875ac80777da2da88a64859775898 Upstream: https://git.openssl.org/?p=openssl.git;a=commit;h=e4840c88c516d959785fcd842d8658d3b7a6ae43 Upstream: https://git.openssl.org/?p=openssl.git;a=commit;h=f141376ae2892b59f2b1af94204f925832f8dc3a Upstream: https://git.openssl.org/?p=openssl.git;a=commit;h=6f35f6deb5ca7daebe289f86477e061ce3ee5f46

Package

Patch details

openssl

Severity score breakdown

Parameter	Value
Base score	9.8 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Cvss 3 Severity Score

Status

Notes

mdeslaur

Patch details

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references