CVE-2016-9939

Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine

published January 30, 2017

CVSS
—
EPSS
4%
Percentile
90.9
In the wild
Unconfirmed
What it is

Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04202 · 90.9th percentile
Published
2017-01-30T21:00Z
EPSS history
Timeline
  • 30 JAN 21:00Z
    Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine
    cvelistv5