Skip to main content

Matrixssl CVE-2016-6892

HIGH
Use After Free (CWE-416)
2017-01-05 cve@mitre.org
7.5
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Jan 05, 2017 - 22:59 cve.org
HIGH 7.5

DescriptionCVE.org

The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) via a crafted X.509 certificate.

AnalysisAI

The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) via a crafted X.509 certificate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

Technical ContextAI

This vulnerability is classified as Use After Free (CWE-416), which allows attackers to access freed memory to execute arbitrary code or crash the application. The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) via a crafted X.509 certificate. Affected products include: Matrixssl. Version information: before 3.8.6.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use smart pointers or garbage-collected languages. Set pointers to NULL after freeing. Enable memory sanitizers.

CVE-2016-6883 MEDIUM POC
5.9 Mar 03

MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a B

CVE-2017-2780 CRITICAL POC
9.8 Jun 22

An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure M

CVE-2017-2781 CRITICAL POC
9.8 Jun 22

An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure M

CVE-2019-14431 CRITICAL POC
9.8 Jul 29

In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based

CVE-2016-6890 CRITICAL
9.8 Jan 05

Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a crafted Sub

CVE-2023-24609 HIGH POC
7.5 Dec 22

Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shar

CVE-2017-2782 MEDIUM POC
6.5 Jun 22

An integer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b.

CVE-2019-13470 CRITICAL
9.8 Jul 09

MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling. Rated critical severity (CVSS 9.8), this vulnera

CVE-2019-10914 CRITICAL
9.8 Apr 08

pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has a stack-based buffer ov

CVE-2016-6891 HIGH
7.5 Jan 05

MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit

CVE-2016-6886 HIGH
7.5 Jan 13

The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory

CVE-2016-6885 HIGH
7.5 Jan 13

The pstm_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free a

Share

CVE-2016-6892 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy