CVE-2016-9132

Critical

Published: 30/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Botan versions 1.8.0 through 1.11.33, an integer overflow could occur when decoding BER data, leading to an incorrect length field being computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way that later causes memory corruption or other failures.

Risk Assessment

Organizations may be exposed to memory corruption or other application failures, potentially leading to unexpected downtime or data loss.

Recommendation

It is recommended to upgrade to the latest version of Botan to mitigate this vulnerability and to monitor applications for abnormal behavior.

Original NVD description (English source)

In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.