#VU640 Heap overflow in Apple Inc. products - CVE-2016-2105

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU640

#VU640 Heap overflow in Apple Inc. products - CVE-2016-2105

Published: September 23, 2016 / Updated: January 13, 2017


Vulnerability identifier: #VU640
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-2105
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
OpenSSL
Oracle Solaris
Oracle Linux
macOS
Oracle Access Manager
Oracle Exalogic Infrastructure
Oracle Enterprise Manager Ops Center
PeopleSoft Enterprise PeopleTools
Oracle VM VirtualBox
Oracle Secure Global Desktop

Oracle E-Business Suite
Oracle Commerce Guided Search
Oracle Agile Engineering Data Management
Oracle Life Sciences Data Hub
Oracle VM Server for x86
Software vendor:
OpenSSL Software Foundation
Oracle

Apple Inc.

Description

The vulnerability allows a remote user to cause heap overflow on the target system.

The weakness is caused by insufficient input validation. By sending a great deal of input data attackers are able to cause overflow of the EVP_EncodeUpdate() function used for binary data encoding.

Successful exploitation of the vulnerability may result in heap overflow on the vulnerable system.

Remediation

Update 1.0.1 to 1.0.1t.
Update 1.0.2 to 1.0.2h.

External links