What’s Vulnerable › Vulnerabilities

CVE-2012-2110

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 47.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2012-04-19 · updated 2026-06-16
• Weakness: CWE-119

Description

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.

Affected products

• OpenSSL: through 0.9.8u; 1.0.0, 1.0.0-beta1, 1.0.0-beta2, 1.0.0-beta3, 1.0.0-beta4, 1.0.0-beta5 (+81)
• RedHat Openssl: 0.9.6-15, 0.9.6b-3, 0.9.7a-2

References

• http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.html
• http://cvs.openssl.org/chngview?cn=22431
• http://cvs.openssl.org/chngview?cn=22434
• http://cvs.openssl.org/chngview?cn=22439
• http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079149.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079299.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080176.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html
• http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00014.html
• http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.html

Get alerted when CVE-2012-2110 or the next vulnerability affects your stack