CVE-2016-0799
CriticalSummary
The fmtstr function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which can lead to denial of service (overflow and out-of-bounds read) due to a long string.
Risk Assessment
Remote attackers may exploit this vulnerability to cause a denial of service, impacting the availability of services using OpenSSL.
Recommendation
It is recommended to update OpenSSL to version 1.0.1s or 1.0.2g to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.