7.5

CVE-2016-2106: openssl Numeric Errors

CVSS: 7.5v3.0HighModified
AliasesALPINE-CVE-2016-2106UBUNTU-CVE-2016-2106DEBIAN-CVE-2016-2106
Published 05-05-2016Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2016-2106 is a high (CVSS 7.5) Numeric Errors vulnerability in openssl. EPSS estimates a 27.26% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (NVD)
EPSS score
27.26%
0%100%
High · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 8
DLA-456-1DSA-3566-1MGASA-2016-0169OPENSUSE-SU-2024:11127-1RHSA-2016:0722RHSA-2016:0996

Timeline

  1. 05-05-2016
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

27.26%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 27.26% on 18-09-2026

18-09-202618-10-2026
EPSS score
27.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat7 products
Alpine1 product
  • openssl< 1.0.2h-r0
Debian1 product
  • openssl< 1.0.2h-1
Openssl1 product
  • opensslEOL≤ 1.0.1s | 1.0.2 | 1.0.2:beta1 | 1.0.2:beta2 | 1.0.2:beta3 | 1.0.2a | 1.0.2b | 1.0.2c | 1.0.2d | 1.0.2e | 1.0.2f | 1.0.2g
Ubuntu1 product
  • openssl< 1.0.1f-1ubuntu2.19 | < 1.0.2g-1ubuntu4.1

5 vendors · 11 products

References

66 links
Show all 66 references