CVE-2016-2842
CriticalSummary
The doapr_outch function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, allowing remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string.
Risk Assessment
Attackers may exploit this vulnerability to trigger a denial of service, potentially leading to system downtime and affecting service availability.
Recommendation
It is recommended to update OpenSSL to version 1.0.1s or 1.0.2g to mitigate this vulnerability and ensure proper memory management.
Original NVD description (English source)
The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799.