Out-of-Bounds Affecting openssl-perl package, versions <0:0.9.8e-40.0.1.el5_11

Q: How to fix?

Upgrade Oracle:5 openssl-perl to version 0:0.9.8e-40.0.1.el5_11 or higher. This issue was patched in ELSA-2016-1137 .

Threat Intelligence

89.38% (100^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-ORACLE5-OPENSSLPERL-2506269
published10 Apr 2022
disclosed5 May 2016

Report a new vulnerability Found a mistake?

Introduced: 5 May 2016

CVE-2016-2108 (opens in a new tab) CWE-119 (opens in a new tab)

How to fix?

Upgrade Oracle:5 openssl-perl to version 0:0.9.8e-40.0.1.el5_11 or higher.
This issue was patched in ELSA-2016-1137.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-perl package and not the openssl-perl package as distributed by Oracle. See How to fix? for Oracle:5 relevant fixed versions and status.

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.