Riskcovery

CVE-2016-7053

CMS Null dereference

State
Published
Severity
Not scored
Published
May 4, 2017
Updated
Sep 16, 2024
Reserved
Aug 23, 2016

Read the record on cve.org

Description

In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
OpenSSLOpenSSL
  • openssl-1.1.0Affected
  • openssl-1.1.0aAffected
  • openssl-1.1.0bAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.