CVE-2016-2105
Node.js 4: Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and…
CVE-2016-2105 is fixed in Node.js 4 on 1 platform by Node.js 4 4.4.4 (version 4.4.4), released May 5, 2016. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.3965
98th percentile
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.4.4 | Node.js 4 4.4.4 | May 5, 2016 |