CVE-2016-0705

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

Affected products

Alt Linux, Centos, Cisco Asa, Cisco Nexus, Freebsd, Ibm Aix, Junos, Mysql Server

Oracle Mysql

≤ 5.6.29, 5.7.11

Fix

Available

CVSS 2.0

10.0 HIGH

CVSS 3.1

9.8 CRITICAL

EPSS

26.3% (98th percentile)

NVD status

Modified

Published

2016-03-03