{"id":"CVE-2015-5727","aliases":["DLA-449-1","DSA-3565-1","EUVD-2015-5673","GHSA-455r-3288-3qq5","MGASA-2016-0102","SUSE-SU-2017:1222-1","UBUNTU-CVE-2015-5727","openSUSE-SU-2024:10477-1"],"status":"published","title":"The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers...","description":"The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01483,"percentile":0.74147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2016-03-07T21:51:48Z","modified":"2026-06-17T00:29:39Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"botan1.10","fixed_in":["1.10.5-1+deb7u1ubuntu0.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"botan1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.5-1+deb7u1"}]}],"versions":["1.10.5-1"],"bundled":7},{"source":"osv","ecosystem":"Debian:8","package":"botan1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-2+deb8u1"}]}],"versions":["1.10.8-2"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.12-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"monotone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1-4.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"softhsm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-5.1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.9-3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.9-3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"botan1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.5-1+deb7u1ubuntu0.14.04.1"}]}],"versions":["1.10.5-1","1.10.5-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.13-1.1"}]}],"bundled":7}],"products":[{"vendor":"botan_project","product":"botan"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"http://www.debian.org/security/2016/dsa-3565","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://botan.randombit.net/security.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5727"},{"url":"https://github.com/advisories/GHSA-455r-3288-3qq5"},{"url":"https://advisories.mageia.org/MGASA-2016-0102.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17737","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171222-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1013209","tags":["report"]},{"url":"https://bugzilla.suse.com/1033605","tags":["report"]},{"url":"https://bugzilla.suse.com/965620","tags":["report"]},{"url":"https://bugzilla.suse.com/965621","tags":["report"]},{"url":"https://bugzilla.suse.com/968025","tags":["report"]},{"url":"https://bugzilla.suse.com/968026","tags":["report"]},{"url":"https://bugzilla.suse.com/968030","tags":["report"]},{"url":"https://bugzilla.suse.com/974521","tags":["report"]},{"url":"https://bugzilla.suse.com/977420","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2801","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5727","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2915","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-5727","description":"The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.","status":"published","published":"2016-05-13T14:00:00Z","modified":"2024-08-06T06:59:04.19Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2015-5673","description":"The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.","status":"published","published":"2016-05-13T14:00:00Z","modified":"2024-08-06T06:59:04Z","updated_at":"2026-11-03T02:21:58.760301Z"}],"ghsa":[{"id":"GHSA-455r-3288-3qq5","title":"The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers...","description":"The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.","status":"published","published":"2022-05-17T03:55:39Z","modified":"2023-01-28T05:00:45Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:43:24.37974Z"}],"nvd":[{"id":"CVE-2015-5727","description":"The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.","status":"published","published":"2016-05-13T14:59:02.1Z","modified":"2026-06-17T00:29:39.903Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"UBUNTU-CVE-2015-5727","description":"The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.","status":"published","published":"2016-05-13T14:59:00Z","modified":"2026-04-22T10:14:37.704022Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"DLA-449-1","title":"botan1.10 - security update","status":"published","published":"2016-04-30T00:00:00Z","modified":"2026-03-09T02:11:43.295781Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-3565-1","title":"botan1.10 - security update","status":"published","published":"2016-05-02T00:00:00Z","modified":"2026-03-09T01:21:13.267229Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0102","title":"Updated botan packages fix security vulnerability","description":"The BER decoder would crash due to reading from offset 0 of an empty\nvector if it encountered a BIT STRING which did not contain any data at\nall. This can be used to easily crash applicatons reading untrusted ASN.1\ndata, but does not seem exploitable for code execution (CVE-2015-5726).\n\nThe BER decoder would allocate a fairly arbitrary amount of memory in a\nlength field, even if there was no chance the read request would succeed.\nThis might cause the process to run out of memory or invoke the OOM killer\n(CVE-2015-5727).\n\nThe ressol function implements the Tonelli-Shanks algorithm for finding\nsquare roots could be sent into a nearly infinite loop due to a misplaced\nconditional check. This could occur if a composite modulus is provided, as\nthis algorithm is only defined for primes. This function is exposed to\nattacker controlled input via the OS2ECP function during ECC point\ndecompression (CVE-2016-2194).\n\nThe PointGFp constructor did not check that the affine coordinate\narguments were less than the prime, but then in curve multiplication\nassumed that both arguments if multiplied would fit into an integer twice\nthe size of the prime. The bigint_mul and bigint_sqr functions received\nthe size of the output buffer, but only used it to dispatch to a faster\nalgorithm in cases where there was sufficient output space to call an\nunrolled multiplication function. The result is a heap overflow accessible\nvia ECC point decoding, which accepted untrusted inputs. This is likely\nexploitable for remote code execution. On systems which use the mlock pool\nallocator, it would allow an attacker to overwrite memory held in\nsecure_vector objects. After this point the write will hit the guard page\nat the end of the mmap'ed region so it probably could not be used for code\nexecution directly, but would allow overwriting adjacent key material\n(CVE-2016-2195).\n","status":"published","published":"2016-03-07T21:51:48Z","modified":"2026-04-16T06:24:43.097987904Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10477-1","title":"libbotan-1_10-1-1.10.13-1.1 on GA media","description":"These are all security issues fixed in the libbotan-1_10-1-1.10.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:38:13.584866Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2017:1222-1","title":"Security update for Botan","description":"\nThis update for Botan to version 1.10.9 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2015-5726: The BER decoder in Botan 0.10.x allowed remote attackers to cause a denial of service (application crash) via an empty BIT STRING in ASN.1 data (bsc#968025).\n- CVE-2015-5727: The BER decoder in Botan 1.10.x allowed remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field (bsc#968026).\n- CVE-2015-7827: Botan make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding (bsc#968030).\n- CVE-2016-2849: Botan do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allowed remote attackers to obtain ECDSA secret keys via a timing side-channel attack (bsc#977420).\n- CVE-2016-9132: In Botan 1.8.0 when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later caused memory corruption or other failure (bsc#1013209).\n- CVE-2016-2194: The ressol function in Botan allowed remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus (bsc#965621).\n- CVE-2016-2195: Integer overflow in the PointGFp constructor in Botan allowed remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow (bsc#965620).\n- CVE-2017-2801: Incorrect comparison in X.509 DN strings (bsc#1033605).\n- CVE-2014-9742: The Miller-Rabin primality check in Botan improperly used a single random base, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group (bsc#974521).\n\nThese non-security issues were fixed:\n\n- Fixed EAX tag verification to run in constant time\n- The default TLS policy now disables SSLv3.\n- A crash could have occured when reading from a blocking random device if the\n  device initially indicated that entropy was available but a concurrent\n  process drained the entropy pool before the read was initiated.\n- Fixed decoding indefinite length BER constructs that contain a context sensitive\n  tag of zero.\n- The key length limit on HMAC has been raised to 512 bytes, allowing the use\n  of very long passphrases with PBKDF2.\n- OAEP had two bugs, one of which allowed it to be used even if the key was\n  too small, and the other of which would cause a crash during decryption if\n  the EME data was too large for the associated key.\n","status":"published","published":"2017-05-09T11:34:34Z","modified":"2026-02-04T03:47:44.080543Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}