CVE-2016-0797
Node.js 4: Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers…
CVE-2016-0797 is fixed in Node.js 4 on 1 platform by Node.js 4 4.3.2 (version 4.3.2), released March 2, 2016. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.2702
98th percentile
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.3.2 | Node.js 4 4.3.2 | Mar 2, 2016 |