CVE-2016-6306

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 41.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-09-26 · updated 2026-06-17
Weakness: CWE-125

Description

The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04
Debian Linux: 8.0
Hewlett Packard Enterprise IceWall Federation Agent: 3.0
HP Icewall Mcrp: 3.0
Hewlett Packard Enterprise HPE Icewall DFW: 10.0
HP Icewall Sso Agent Option: 10.0
Node.js: from 0.10.0 before 0.10.47; from 0.12.0 before 0.12.16; from 4.0.0 through 4.1.2; from 4.2.0 before 4.6.0; from 5.0.0 through 5.12.0; from 6.0.0 before 6.7.0 — fixed in 0.10.47, 0.12.16, 4.6.0, 6.7.0
Novell Suse Linux Enterprise Module For Web Scripting: 12.0
OpenSSL: 1.0.1, 1.0.1-beta1, 1.0.1-beta2, 1.0.1-beta3, 1.0.1a, 1.0.1b (+29)

How to fix

Upgrade to a fixed version: Node.js 0.10.47, 0.12.16, 4.6.0, 6.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-6306 or the next vulnerability affects your stack