Vulnerability CVE-2016-2108 is an issue with the ASN.1 parser that triggers a buffer underflow and performs an out-of-bounds write if zero is represented as a negative value and affects the OpenSSL version, released before April 2015 and consists of two in themselves insignificant errors which together could pose a serious threat.
OpenSSL Fixed Six Severe Flaws
Under certain conditions, an attacker can execute irrational code remotely. The second dangerous vulnerability (CVE-2016-2107) allows one to carry out the attack “man in the middle” and decrypt the data. However, there was an unrelated bug where the ASN.1 parser could misinterpret a large universal tag as a negative zero value. The OpenSSL team wrote, “This has been shown to cause memory corruption that is potentially exploitable with some malloc implementations”. The flaw, CVE-2016-2105, and CVE-2016-2106 affect the EVP_EncodeUpdate function. As reported in the security bulletin, the chances of the remotely executed code are very small. The vulnerability CVE-2016-2109 can cause large amounts of memory distribution, leading to over-consumption of resources or memory overflow. OpenSSL also fixed an oracle padding issue, where attackers could corrupt the plaintext padding around encrypted messages and decrypt traffic. The final low-severity flaw, CVE-2016-2176 is a vulnerability that allows you to call an overload X509_NAME_oneline() function using the EBCDIC systems, resulting in an attacker can get back some of the data. However, this amount of data is almost useless to the attacker.
