CVE-2016-7053 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2016-7053 Interim 1 20 2024-07-03T02:05:04Z current 2021-05-30T13:45:16Z 2024-07-03T02:05:04Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2016-7053 In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Server 11 SP1 for Teradata SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Server 11 SP4-LTSS SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Studio Onsite 1.3 libopenssl-devel libopenssl0_9_8 libopenssl0_9_8-32bit libopenssl0_9_8-hmac libopenssl0_9_8-hmac-32bit libopenssl1_0_0 libopenssl1_0_0-32bit libopenssl1_0_0-hmac libopenssl1_0_0-hmac-32bit openssl openssl-doc libopenssl1_0_0 as a component of SUSE Linux Enterprise Desktop 12 SP1 libopenssl1_0_0-32bit as a component of SUSE Linux Enterprise Desktop 12 SP1 openssl as a component of SUSE Linux Enterprise Desktop 12 SP1 openssl as a component of SUSE Linux Enterprise Server 11 SP1 for Teradata openssl as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata libopenssl0_9_8 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libopenssl0_9_8-32bit as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libopenssl0_9_8-hmac as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libopenssl0_9_8-hmac-32bit as a component of SUSE Linux Enterprise Server 11 SP4-LTSS openssl as a component of SUSE Linux Enterprise Server 11 SP4-LTSS openssl-doc as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libopenssl1_0_0 as a component of SUSE Linux Enterprise Server 12 SP1 libopenssl1_0_0-32bit as a component of SUSE Linux Enterprise Server 12 SP1 libopenssl1_0_0-hmac as a component of SUSE Linux Enterprise Server 12 SP1 libopenssl1_0_0-hmac-32bit as a component of SUSE Linux Enterprise Server 12 SP1 openssl as a component of SUSE Linux Enterprise Server 12 SP1 openssl-doc as a component of SUSE Linux Enterprise Server 12 SP1 libopenssl-devel as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0 as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-32bit as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-hmac as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-hmac-32bit as a component of SUSE Linux Enterprise Server 12 SP2 openssl as a component of SUSE Linux Enterprise Server 12 SP2 openssl-doc as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl-devel as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 openssl as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libopenssl-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 openssl as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 libopenssl-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 openssl as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libopenssl-devel as a component of SUSE Studio Onsite 1.3 openssl as a component of SUSE Studio Onsite 1.3 In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected. CVE-2016-7053 SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0 SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit SUSE Linux Enterprise Desktop 12 SP1:openssl SUSE Linux Enterprise Server 11 SP1 for Teradata:openssl SUSE Linux Enterprise Server 11 SP3 for Teradata:openssl SUSE Linux Enterprise Server 11 SP4-LTSS:libopenssl0_9_8 SUSE Linux Enterprise Server 11 SP4-LTSS:libopenssl0_9_8-32bit SUSE Linux Enterprise Server 11 SP4-LTSS:libopenssl0_9_8-hmac SUSE Linux Enterprise Server 11 SP4-LTSS:libopenssl0_9_8-hmac-32bit SUSE Linux Enterprise Server 11 SP4-LTSS:openssl SUSE Linux Enterprise Server 11 SP4-LTSS:openssl-doc SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0 SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit SUSE Linux Enterprise Server 12 SP1:openssl SUSE Linux Enterprise Server 12 SP1:openssl-doc SUSE Linux Enterprise Server 12 SP2:libopenssl-devel SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0 SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-32bit SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-hmac SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-hmac-32bit SUSE Linux Enterprise Server 12 SP2:openssl SUSE Linux Enterprise Server 12 SP2:openssl-doc SUSE Linux Enterprise Software Development Kit 11 SP4:libopenssl-devel SUSE Linux Enterprise Software Development Kit 11 SP4:openssl SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel SUSE Linux Enterprise Software Development Kit 12 SP1:openssl SUSE Linux Enterprise Software Development Kit 12 SP2:libopenssl-devel SUSE Linux Enterprise Software Development Kit 12 SP2:openssl SUSE Studio Onsite 1.3:libopenssl-devel SUSE Studio Onsite 1.3:openssl important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H