Skip to content
Fencer Vulns
critical 9.8

CVE-2016-2177 in the critical feed json

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a d…

published 2016-06-20 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-3262

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
44.5%
EPSS 44.5% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.

Patch / fix

  • openssl Debian 14, Debian 13, Debian 12 1.0.2i-1

debian advisories DEBIAN-CVE-2016-2177

  • openssl Ubuntu 14.04 LTS 1.0.1f-1ubuntu2.22
  • openssl Ubuntu 16.04 LTS 1.0.2g-1ubuntu4.4

ubuntu advisories UBUNTU-CVE-2016-2177

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl RHEL 6 1.0.1e-48.el6_8.3
  • openssl RHEL 7 1:1.0.1e-51.el7_2.7
  • openssl-libs RHEL 7 1:1.0.1e-51.el7_2.7
  • openssl-perl RHEL 6 1.0.1e-48.el6_8.3
  • openssl-perl RHEL 7 1:1.0.1e-51.el7_2.7
  • jbcs-httpd24-httpd jboss core services 1 2.4.23-102.jbcs.el7
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.41-14.redhat_1.jbcs.el7
  • jbcs-httpd24-mod_rt jboss core services 1 2.4.1-16.GA.jbcs.el7

red hat advisories RHSA-2016:1940RHSA-2017:0194RHSA-2017:0193RHSA-2017:1658

  • compat-openssl098 SLES for SAP 12 SP1, SLED 12 SP1, SLE Module for Legacy 12 0.9.8j-102.1
  • openssl1 SLES 11-SECURITY 1.0.1g-0.52.1
  • openssl Studio Onsite 1.3, SLES for SAP 11 SP4, SLES 11 SP4 +8 more 0.9.8j-0.102.2
  • openssl SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 1.0.1i-52.1
  • compat-openssl097g SLES for SAP 11 SP4, SLES for SAP 11 SP3 0.9.7g-146.22.47.1
  • openssl SLES for SAP 12, SLES 12-LTSS 1.0.1i-27.21.1

suse advisories SUSE-SU-2016:2545-1SUSE-SU-2016:2468-1SUSE-SU-2016:2469-1SUSE-SU-2016:2458-1SUSE-SU-2016:2394-1SUSE-SU-2016:2387-1

  • openssl-1_1 openSUSE Tumbleweed 1.1.1l-1.2

opensuse advisories openSUSE-SU-2024:11127-1

  • openssl Alpine 3.8, Alpine 3.7, Alpine 3.6 +4 more 1.0.2h-r1

alpine advisories ALPINE-CVE-2016-2177

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl Arch Linux 1.0.2.i-1
  • lib32-openssl Arch Linux 1:1.0.2.i-1

arch linux advisories AVG-29AVG-30

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-2177 updated cvss 5.9

openssl: Possible integer overflow vulnerabilities in codebase

  • Red Hat Enterprise Linux 5 openssl, openssl097a Red Hat Enterprise Linux 6 openssl098e Red Hat Enterprise Linux 7 openssl098e Red Hat JBoss Enterprise Web Server 1 openssl Red Hat JBoss Enterprise Web Server 2 openssl
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Web Server 3 openssl
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux Client (v. 7) openssl 1.0.1e-51.el7_2.7, openssl-libs 1.0.1e-51.el7_2.7 Red Hat Enterprise Linux Client Optional (v. 7) openssl-perl 1.0.1e-51.el7_2.7 Red Hat Enterprise Linux ComputeNode (v. 7) openssl 1.0.1e-51.el7_2.7, openssl-libs 1.0.1e-51.el7_2.7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-perl 1.0.1e-51.el7_2.7 Red Hat Enterprise Linux Desktop (v. 6) openssl 1.0.1e-48.el6_8.3 Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-perl 1.0.1e-48.el6_8.3
    +10 more products
    Red Hat Enterprise Linux HPC Node (v. 6) openssl 1.0.1e-48.el6_8.3 Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-perl 1.0.1e-48.el6_8.3 Red Hat Enterprise Linux Server (v. 6) openssl 1.0.1e-48.el6_8.3 Red Hat Enterprise Linux Server (v. 7) openssl 1.0.1e-51.el7_2.7, openssl-libs 1.0.1e-51.el7_2.7 Red Hat Enterprise Linux Server Optional (v. 6) openssl-perl 1.0.1e-48.el6_8.3 Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl 1.0.1e-51.el7_2.7 Red Hat Enterprise Linux Workstation (v. 6) openssl 1.0.1e-48.el6_8.3 Red Hat Enterprise Linux Workstation (v. 7) openssl 1.0.1e-51.el7_2.7, openssl-libs 1.0.1e-51.el7_2.7 Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-perl 1.0.1e-48.el6_8.3 Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl 1.0.1e-51.el7_2.7
    fixed: vendor fix RHSA-2016:1940
  • Red Hat JBoss Core Services
    fixed: vendor fix RHSA-2016:2957
  • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd 2.4.23-102.jbcs.el6, jbcs-httpd24-nghttp2 1.12.0-9.jbcs.el6, jbcs-httpd24-openssl 1.0.2h-12.jbcs.el6, jbcs-httpd24-mod_rt 2.4.1-16.GA.jbcs.el6, jbcs-httpd24-mod_ssl 2.4.23-102.jbcs.el6, jbcs-httpd24-mod_bmx 0.9.6-14.GA.jbcs.el6, +21 more
    fixed: vendor fix RHSA-2017:0193
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd 2.4.23-102.jbcs.el7, jbcs-httpd24-nghttp2 1.12.0-9.jbcs.el7, jbcs-httpd24-openssl 1.0.2h-12.jbcs.el7, jbcs-httpd24-mod_rt 2.4.1-16.GA.jbcs.el7, jbcs-httpd24-mod_ssl 2.4.23-102.jbcs.el7, jbcs-httpd24-mod_bmx 0.9.6-14.GA.jbcs.el7, +19 more
    fixed: vendor fix RHSA-2017:0194
  • Red Hat JBoss Enterprise Application Platform 6.4
    fixed: vendor fix RHSA-2017:1659
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jbcs-httpd24-openssl 1.0.2h-13.jbcs.el6, jbcs-httpd24-openssl-libs 1.0.2h-13.jbcs.el6, jbcs-httpd24-openssl-perl 1.0.2h-13.jbcs.el6 Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server jbcs-httpd24-openssl 1.0.2h-13.jbcs.el7, jbcs-httpd24-openssl-libs 1.0.2h-13.jbcs.el7, jbcs-httpd24-openssl-perl 1.0.2h-13.jbcs.el7
    fixed: vendor fix RHSA-2017:1658

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-349-21 updated cvss 9.8

Siemens SCALANCE X-200RNA Switch Devices

  • Siemens SCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2) <V3.2.7 Siemens SCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2) <V3.2.7 Siemens SCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3) <V3.2.7
    affected: fixed in V3.2.7, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-18-144-01 updated cvss 9.8

Schneider Electric Floating License Manager

  • Schneider Electric Software, LLC CitectHistorian 2016 Schneider Electric Software, LLC CitectSCADA 2015, 2016 Schneider Electric Software, LLC EcoStruxure Modicon Builder <= 3.0 Schneider Electric Software, LLC EcoStruxure Power Monitoring Expert 8.2 (Standard DC HC Editions) Schneider Electric Software, LLC EcoStruxure Power SCADA Operations 8.x (formerly PowerSCADA Expert) (Only with Advanced Reports and Dashboards Module) Schneider Electric Software, LLC Energy Expert 1.x (formerly Power Manager)
    +4 more products
    Schneider Electric Software, LLC PlantStruxure PES <=8.1 (Standard DC HC Editions) Schneider Electric Software, LLC SCADA Expert Vijeo Citect / CitectSCADA 7.30, 7.40 Schneider Electric Software, LLC StruxureWare Power Monitoring Expert 7.2.x, 8.1 (Standard DC HC Editions), 8.0 (Standard DC HC Buildings Editions) Schneider Electric Software, LLC Vijeo Historian/CitectHistorian 4.40, 4.50
    affected: mitigation “Schneider Electric recommends that users of affected Citect and PlantStruxure products download and install the new version of the software” citect.schneider-electric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

44.51% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.