CVE-2016-6306
Node.js 4: The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers…
CVE-2016-6306 is fixed in Node.js 4 on 1 platform by Node.js 4 4.6.0 (version 4.6.0), released September 27, 2016. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
5.9
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.4168
98th percentile
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.6.0 | Node.js 4 4.6.0 | Sep 27, 2016 |