CVE-2016-2842

CRITICAL

The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799.

Published: Mar 3, 2016 Modified: May 6, 2026

CWE-119

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (32)

Vendor	Product	Version
openssl	openssl	1.0.1
openssl	openssl	1.0.1
openssl	openssl	1.0.1
openssl	openssl	1.0.1
openssl	openssl	1.0.1a
openssl	openssl	1.0.1b
openssl	openssl	1.0.1c
openssl	openssl	1.0.1d
openssl	openssl	1.0.1e
openssl	openssl	1.0.1f
openssl	openssl	1.0.1g
openssl	openssl	1.0.1h
openssl	openssl	1.0.1i
openssl	openssl	1.0.1j
openssl	openssl	1.0.1k
openssl	openssl	1.0.1l
openssl	openssl	1.0.1m
openssl	openssl	1.0.1n
openssl	openssl	1.0.1o
openssl	openssl	1.0.1p

…and 12 more

GitHub Security Advisory GHSA-jj34-65xr-hwrp

The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before...

References (54)

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 54.30%

Top 2% most likely to be exploited

Threat Score 55.5 / 100

Data Sources

NVD EPSS GitHub