CVE-2016-2177
CriticalSummary
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact.
Risk Assessment
This vulnerability may lead to application crashes, affecting service availability and potentially being exploited for further attacks on the system.
Recommendation
It is recommended to upgrade OpenSSL to version 1.0.2i or later to mitigate this vulnerability.
Original NVD description (English source)
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.