What is CVE-2012-2110?

CVE-2012-2110 is a vulnerability in Openssl, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2012-04-19.

Is CVE-2012-2110 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Openssl

CVE-2012-2110

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and…

Vulnerability class: Buffer Overflow

EPSS: 0.483 (98.7th percentile) — read the EPSS interpretation.

Affected products

Openssl — versions 1.0.0, 1.0.0a, 1.0.0b
Redhat Openssl — versions 0.9.6-15, 0.9.6b-3, 0.9.7a-2
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

References

secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_HP, vendor-advisory)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
secalert@redhat.com (mailing-list, Exploit, x_refsource_FULLDISC)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)

Frequently asked questions

What is CVE-2012-2110?: CVE-2012-2110 is a vulnerability in Openssl, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2012-04-19.
Is CVE-2012-2110 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.