CVE-2016-9939

Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.

Database specific

{
    "unresolved_ranges": [
        {
            "vendor_product": "debian:debian_linux",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

References

Affected packages

Git / github.com/weidai11/cryptopp

Affected ranges

Type

GIT

Repo

https://github.com/weidai11/cryptopp

Events

Introduced

4132d85888ac6c30729f58bb442a4a26a5b16cfe

Last affected

4132d85888ac6c30729f58bb442a4a26a5b16cfe

Database specific

{
    "cpe": "cpe:2.3:a:cryptopp:crypto\\+\\+:5.6.4:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "5.6.4"
        },
        {
            "last_affected": "5.6.4"
        }
    ]
}

Affected versions

5.*

5.6.4

Other

CRYPTOPP_5_6_4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9939.json"