CVE-2016-2180 - CVE House
Back to Database
Status published High CVE-2016-2180

The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key...

Vulnerability Description

The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-2180

Credits & Attribution

No credits recorded in the NVD database.

References

More from openssl

View All →
CVE-2016-7055
There is a carry propagating bug in the Broadwell-specific Montgomery...
Medium 5.9
CVE-2016-6309
statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after...
Critical 9.8
CVE-2016-6308
statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a...
Medium 5.9
CVE-2016-6307
The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory...
Medium 5.9
CVE-2016-6306
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before...
Medium 5.9

Affected Vendor

Affected Software

openssl, linux
Vulnerable Versions:
1.0.1, 1.0.1a, 1.0.1b, 1.0.1c, 1.0.1d, 1.0.1e, 1.0.1f, 1.0.1g, 1.0.1h, 1.0.1i, 1.0.1j, 1.0.1k, 1.0.1l, 1.0.1m, 1.0.1n, 1.0.1o, 1.0.1p, 1.0.1q, 1.0.1r, 1.0.1s, 1.0.1t, 1.0.2, 1.0.2a, 1.0.2b, 1.0.2c, 1.0.2d, 1.0.2e, 1.0.2f, 1.0.2g, 1.0.2h, 6, 7

Timeline

Official Publish: August 1st, 2016
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.