critical9.8
CVE-2016-2195
Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute…
Impact
Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Botan Project | Botan | through 1.10.10 Versions 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.11.4 |
| Debian | Debian Linux | Version 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://botan.randombit.net/security.html
- http://marc.info/?l=botan-devel&m=145435148602911&w=2
- http://www.debian.org/security/2016/dsa-3565
- https://security.gentoo.org/glsa/201612-38
- http://botan.randombit.net/security.html
- http://marc.info/?l=botan-devel&m=145435148602911&w=2
- http://www.debian.org/security/2016/dsa-3565
- https://security.gentoo.org/glsa/201612-38