CVE-2016-2176

The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2...

8.2 HighFix available

CVE-2016-2176 is a high vulnerability (CVSS 8.2) in Openssl, published May 5, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 23.4%, the 97th percentile. Fixed in openssl 1.0.2h-r0.

The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: High

Exploit likelihood

23.4%Up 15.8 points since Aug 1, 2022

What each source reports

NVD Score used 8.2

Record: CVE-2016-2176
CVSS 3.0: 8.2 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-2176
Updated: 2026-11-02

EUVDEUVD-2016-3261 No score

Record: EUVD-2016-3261
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9p7f-7v7j-rq7j 8.2

The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2...

Record: GHSA-9p7f-7v7j-rq7j
CVSS 3.0: 8.2 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSVALPINE-CVE-2016-2176 8.2

Record: ALPINE-CVE-2016-2176
CVSS 3.0: 8.2 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2016-2176 8.2

CVE-2016-2176 does not affect BellSoft software

Record: BELL-CVE-2016-2176
CVSS 3.0: 8.2 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSV 8.2

Record: CVE-2016-2176
CVSS 3.0: 8.2 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10271-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10529-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11127-1
Updated: 2026-11-02

OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

Introduce venv-salt-minion.
Mention fixed issues provided with the bundle.

Record: SUSE-FU-2022:0445-1
Updated: 2026-11-02

Affected products

openssl

Affected packages

Affected packages
Package	Affected	Fixed
`openssl` Alpine:v3.2	before 1.0.2h-r0	1.0.2h-r0
`openssl` Alpine:v3.3	before 1.0.2h-r0	1.0.2h-r0
`openssl` Alpine:v3.4	before 1.0.2h-r0	1.0.2h-r0
`openssl` Alpine:v3.5	before 1.0.2h-r0	1.0.2h-r0
`openssl` Alpine:v3.6	before 1.0.2h-r0	1.0.2h-r0
`openssl` Alpine:v3.7	before 1.0.2h-r0	1.0.2h-r0
`openssl` Alpine:v3.8	before 1.0.2h-r0	1.0.2h-r0
`openssl-1_1` openSUSE:Tumbleweed	before 1.1.1l-1.2	1.1.1l-1.2