CVE-2016-0705

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 26.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-03-03 · updated 2026-06-17

Description

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 15.10
Debian Linux: 7.0, 8.0
Android: 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1 (+16)
OpenSSL: 1.0.1, 1.0.1-beta1, 1.0.1-beta2, 1.0.1-beta3, 1.0.1a, 1.0.1b (+26)
MySQL Server: from 5.6.0 through 5.6.29; from 5.7.0 through 5.7.11

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178358.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178817.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html

Get alerted when CVE-2016-0705 or the next vulnerability affects your stack