CVE-2016-6309
Critical · 9.8CVSS
9.8
EPSS
70.2%
Published
Sep 26, 2016
CISA due date
—
The record
statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:5 | kmod-vboxadditions | 0 | 5.1.10-1.1.mga5 |
| Mageia:5 | kmod-virtualbox | 0 | 5.1.10-1.1.mga5 |
| Mageia:5 | virtualbox | 0 | 5.1.10-1.1.mga5 |
Related vulnerabilities
- CVE-2017-5754 Systems with microprocessors utilizing speculative execution and indirect branch… Also affects kmod-vboxadditions
- CVE-2017-5753 Systems with microprocessors utilizing speculative execution and branch prediction may… Also affects kmod-vboxadditions
- CVE-2017-1000410 The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the… Also affects kmod-vboxadditions
- CVE-2017-15115 The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does… Also affects kmod-vboxadditions
- CVE-2017-13080 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key… Also affects kmod-vboxadditions
- CVE-2017-15265 Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users… Also affects kmod-vboxadditions
- CVE-2017-1000112 Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. Also affects kmod-vboxadditions
- CVE-2017-1000252 The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a… Also affects kmod-vboxadditions