{
  "threat_severity" : "Low",
  "public_date" : "2016-03-01T00:00:00Z",
  "bugzilla" : {
    "description" : "OpenSSL: BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption",
    "id" : "1311880",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1311880"
  },
  "cvss" : {
    "cvss_base_score" : "4.3",
    "cvss_scoring_vector" : "AV:N/AC:M/Au:N/C:N/I:N/A:P",
    "status" : "verified"
  },
  "details" : [ "Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.", "An integer overflow flaw, leading to a NULL pointer dereference or a heap-based memory corruption, was found in the way some BIGNUM functions of OpenSSL were implemented. Applications that use these functions with large untrusted input could crash or, potentially, execute arbitrary code." ],
  "acknowledgement" : "Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Guido Vranken as the original reporter.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "release_date" : "2016-03-01T00:00:00Z",
    "advisory" : "RHSA-2016:0302",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5",
    "package" : "openssl-0:0.9.8e-39.el5_11"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2016-03-01T00:00:00Z",
    "advisory" : "RHSA-2016:0301",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "openssl-0:1.0.1e-42.el6_7.4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2016-03-01T00:00:00Z",
    "advisory" : "RHSA-2016:0301",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "openssl-1:1.0.1e-51.el7_2.4"
  }, {
    "product_name" : "RHEV 3.X Hypervisor and Agents for RHEL-6",
    "release_date" : "2016-03-09T00:00:00Z",
    "advisory" : "RHSA-2016:0379",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6::hypervisor",
    "package" : "rhev-hypervisor7-0:7.2-20160302.1.el6ev"
  }, {
    "product_name" : "RHEV 3.X Hypervisor and Agents for RHEL-7",
    "release_date" : "2016-03-09T00:00:00Z",
    "advisory" : "RHSA-2016:0379",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7::hypervisor",
    "package" : "rhev-hypervisor7-0:7.2-20160302.1.el7ev"
  }, {
    "product_name" : "Text-Only JBCS",
    "release_date" : "2016-12-15T00:00:00Z",
    "advisory" : "RHSA-2016:2957",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux Extended Update Support 6.7",
    "fix_state" : "Affected",
    "package_name" : "guest-images",
    "cpe" : "cpe:/o:redhat:rhel_eus:6.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux Extended Update Support 7.2",
    "fix_state" : "Affected",
    "package_name" : "rhel-guest-image",
    "cpe" : "cpe:/o:redhat:rhel_eus:7.2"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Not affected",
    "package_name" : "openssl",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 2",
    "fix_state" : "Not affected",
    "package_name" : "openssl",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:2"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 3",
    "fix_state" : "Affected",
    "package_name" : "openssl",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2016-0797\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-0797\nhttps://www.openssl.org/news/secadv/20160301.txt" ],
  "name" : "CVE-2016-0797",
  "csaw" : false
}