{"id":"CVE-2016-2196","details":"Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (memory overwrite and crash) or execute arbitrary code via unspecified vectors.","modified":"2026-10-24T10:30:44.544937020Z","published":"2016-05-13T14:59:09.760Z","database_specific":{},"references":[{"type":"ADVISORY","url":"http://botan.randombit.net/security.html"},{"type":"ADVISORY","url":"http://marc.info/?l=botan-devel&m=145435148602911&w=2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/randombit/botan","events":[{"introduced":"ee912cd748a9b0bf56c84a49896dd2d57e0f81a6"},{"last_affected":"9d3ad9a0f44a9321185ed9f221c828dac81b9f0c"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.11.0"},{"last_affected":"1.11.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.0:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.1:*:*:*:*:*:*:*","range":[{"introduced":"1.11.1"},{"last_affected":"1.11.1"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.2:*:*:*:*:*:*:*","range":[{"introduced":"1.11.2"},{"last_affected":"1.11.2"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.3:*:*:*:*:*:*:*","range":[{"introduced":"1.11.3"},{"last_affected":"1.11.3"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.4:*:*:*:*:*:*:*","range":[{"introduced":"1.11.4"},{"last_affected":"1.11.4"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.5:*:*:*:*:*:*:*","range":[{"introduced":"1.11.5"},{"last_affected":"1.11.5"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.6:*:*:*:*:*:*:*","range":[{"introduced":"1.11.6"},{"last_affected":"1.11.6"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.11.7"},{"last_affected":"1.11.7"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.7:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.8:*:*:*:*:*:*:*","range":[{"introduced":"1.11.8"},{"last_affected":"1.11.8"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.9:*:*:*:*:*:*:*","range":[{"introduced":"1.11.9"},{"last_affected":"1.11.9"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.10:*:*:*:*:*:*:*","range":[{"introduced":"1.11.10"},{"last_affected":"1.11.10"}]},{"range":[{"introduced":"1.11.11"},{"last_affected":"1.11.11"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.11:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.12:*:*:*:*:*:*:*","range":[{"introduced":"1.11.12"},{"last_affected":"1.11.12"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.13:*:*:*:*:*:*:*","range":[{"introduced":"1.11.13"},{"last_affected":"1.11.13"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.14:*:*:*:*:*:*:*","range":[{"introduced":"1.11.14"},{"last_affected":"1.11.14"}]},{"range":[{"introduced":"1.11.15"},{"last_affected":"1.11.15"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.15:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.16:*:*:*:*:*:*:*","range":[{"introduced":"1.11.16"},{"last_affected":"1.11.16"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.17:*:*:*:*:*:*:*","range":[{"introduced":"1.11.17"},{"last_affected":"1.11.17"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.18:*:*:*:*:*:*:*","range":[{"introduced":"1.11.18"},{"last_affected":"1.11.18"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.19:*:*:*:*:*:*:*","range":[{"introduced":"1.11.19"},{"last_affected":"1.11.19"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.11.20"},{"last_affected":"1.11.20"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.20:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.21:*:*:*:*:*:*:*","range":[{"introduced":"1.11.21"},{"last_affected":"1.11.21"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.22:*:*:*:*:*:*:*","range":[{"introduced":"1.11.22"},{"last_affected":"1.11.22"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.11.23"},{"last_affected":"1.11.23"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.23:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.24:*:*:*:*:*:*:*","range":[{"introduced":"1.11.24"},{"last_affected":"1.11.24"}]},{"range":[{"introduced":"1.11.25"},{"last_affected":"1.11.25"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.25:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.11.26"},{"last_affected":"1.11.26"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.26:*:*:*:*:*:*:*"}]}}],"versions":["1.11.0","1.11.1","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.19","1.11.2","1.11.20","1.11.21","1.11.22","1.11.23","1.11.24","1.11.25","1.11.26","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2196.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}