CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2016-6309

CVSS 9.8v3.0pub. 2016-09-26upd. 2026-05-06

statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • OpenSSL

    APP
    Openssl
    1.1.0a
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCEDoSMemory
CWE
References

Related vulnerabilities

CVE-2026-34182CRITICAL9.1PL ✓ten sam produkt

OpenSSL CMS AuthEnvelopedData — niewystarczająca walidacja wejścia umożliwia atak oracle i bypass integralnośc...

CVE-2026-31789CRITICAL9.8PL ✓ten sam produkt

OpenSSL: heap buffer overflow przy konwersji OCTET STRING na hex (32-bit)

CVE-2022-2274CRITICAL9.8ten sam produkt

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AV...

CVE-2021-3711CRITICAL9.8ten sam produkt

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt()....

CVE-2020-7043CRITICAL9.1ten sam produkt

An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certif...