CVE-2016-0705

Critical

Published: 03/03/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A double free vulnerability in the dsa_priv_decode function in OpenSSL before version 1.0.1s and 1.0.2 before version 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

Risk Assessment

Organizations may be exposed to attacks that lead to system crashes or other unforeseen consequences, potentially affecting service availability.

Recommendation

It is recommended to update OpenSSL to version 1.0.1s or 1.0.2g to mitigate this vulnerability.

Original NVD description (English source)

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.