PT-2017-9050 · Matrixssl · Matrixssl

Craig Young · Published 2017-01-05 · Updated 2017-01-06 · CVE-2016-6891

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MatrixSSL versions prior to 3.8.6

Description The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds read. This occurs when a crafted ASN.1 Bit Field primitive is present in an X.509 certificate.

Recommendations For versions prior to 3.8.6, update to version 3.8.6 or later to resolve the issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2016-6891

Affected Products

Matrixssl

References · 6

• ❌ https://github.com/matrixssl/matrixssl/blob/3-8-6-open/CHANGES.md · Patch, Deleted
• https://osv.dev/vulnerability/CVE-2016-6891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6891 · Security Note
• https://kb.cert.org/vuls/id/396440 · Note
• http://securityfocus.com/bid/93498 · Note
• http://tripwire.com/state-of-security/security-data-protection/cyber-security/flawed-matrixssl-code-highlights-need-for-better-iot-update-practices · Note