CVE-2016-2182

Critical

Published: 16/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The BN_bn2dec function in OpenSSL before 1.1.0 does not properly validate division results, which may lead to application crashes or denial of service.

Risk Assessment

Remote attackers may exploit this vulnerability to cause application crashes, potentially leading to service unavailability.

Recommendation

It is recommended to upgrade OpenSSL to version 1.1.0 or later to mitigate this vulnerability.

Original NVD description (English source)

The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.