OpenSSL CVE-2016-7053 Denial of Service Vulnerability

Description

Severity: ModerateApplications parsing invalid CMS structures can crash with a NULL pointerdereference. This is caused by a bug in the handling of the ASN.1 CHOICE typein OpenSSL 1.1.0 which can result in a NULL value being passed to the structurecallback if an attempt is made to free certain invalid encodings. Only CHOICEstructures using a callback which do not handle NULL value are affected.OpenSSL 1.1.0 users should upgrade to 1.1.0cThis issue does not affect OpenSSL versions prior to 1.1.0This issue was reported to OpenSSL on 12th October 2016 by Tyler Nighswander ofForAllSecure. The fix was developed by Stephen Henson of the OpenSSLdevelopment team.

Affected Applications

OpenSSL

CVE References

Other References