CVE-2016-2195
CriticalSummary
Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to the integrity and confidentiality of the system.
Recommendation
It is recommended to update to the latest version of Botan to mitigate this vulnerability and to conduct a security audit of applications using this library.
Original NVD description (English source)
Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow.