{"id":"CVE-2016-9132","details":"In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.","modified":"2026-10-20T10:48:46.851517622Z","published":"2017-01-30T22:59:00.827Z","related":["SUSE-SU-2017:1222-1","SUSE-SU-2017:1305-1","SUSE-SU-2017:1351-1","openSUSE-SU-2024:10594-1"],"database_specific":{"unresolved_ranges":[{"vendor_product":"botan_project:botan","cpes":["cpe:2.3:a:botan_project:botan:1.10.10:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"1.10.10"},{"last_affected":"1.10.10"}],"source":"CPE_STRING"}]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OUDGVRQYQUL7F5MRP3LAV7EHRJG4BBE/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2Y3JLMTE3VIV4X5X6SXVZTJBDDLCS3D/"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/95879"},{"type":"FIX","url":"https://github.com/randombit/botan/commit/987ad747db6d0d7e36f840398f3cf02e2fbfd90f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/randombit/botan","events":[{"introduced":"5de3c5deb3ef63e1759bdf73337ffb45e063dd9c"},{"last_affected":"560c0e5623cd9ef704b06c56b7e827e7431ae1a8"},{"fixed":"987ad747db6d0d7e36f840398f3cf02e2fbfd90f"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.8.0"},{"last_affected":"1.8.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.8.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.8.1"},{"last_affected":"1.8.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.8.1:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.8.2:*:*:*:*:*:*:*","range":[{"introduced":"1.8.2"},{"last_affected":"1.8.2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.8.3:*:*:*:*:*:*:*","range":[{"introduced":"1.8.3"},{"last_affected":"1.8.3"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.8.4:*:*:*:*:*:*:*","range":[{"introduced":"1.8.4"},{"last_affected":"1.8.4"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.8.5:*:*:*:*:*:*:*","range":[{"introduced":"1.8.5"},{"last_affected":"1.8.5"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.8.6:*:*:*:*:*:*:*","range":[{"introduced":"1.8.6"},{"last_affected":"1.8.6"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.8.7"},{"last_affected":"1.8.7"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.8.7:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.8.8:*:*:*:*:*:*:*","range":[{"introduced":"1.8.8"},{"last_affected":"1.8.8"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.8.9:*:*:*:*:*:*:*","range":[{"introduced":"1.8.9"},{"last_affected":"1.8.9"}]},{"range":[{"introduced":"1.8.10"},{"last_affected":"1.8.10"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.8.10:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.8.11:*:*:*:*:*:*:*","range":[{"introduced":"1.8.11"},{"last_affected":"1.8.11"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.8.12"},{"last_affected":"1.8.12"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.8.12:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.8.13:*:*:*:*:*:*:*","range":[{"introduced":"1.8.13"},{"last_affected":"1.8.13"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.8.14:*:*:*:*:*:*:*","range":[{"introduced":"1.8.14"},{"last_affected":"1.8.14"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.8.15:*:*:*:*:*:*:*","range":[{"introduced":"1.8.15"},{"last_affected":"1.8.15"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.0:*:*:*:*:*:*:*","range":[{"introduced":"1.9.0"},{"last_affected":"1.9.0"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.1:*:*:*:*:*:*:*","range":[{"introduced":"1.9.1"},{"last_affected":"1.9.1"}]},{"range":[{"introduced":"1.9.2"},{"last_affected":"1.9.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.2:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.3:*:*:*:*:*:*:*","range":[{"introduced":"1.9.3"},{"last_affected":"1.9.3"}]},{"range":[{"introduced":"1.9.4"},{"last_affected":"1.9.4"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.4:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.5:*:*:*:*:*:*:*","range":[{"introduced":"1.9.5"},{"last_affected":"1.9.5"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.9.6:*:*:*:*:*:*:*","range":[{"introduced":"1.9.6"},{"last_affected":"1.9.6"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.9.7"},{"last_affected":"1.9.7"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.7:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.9.8:*:*:*:*:*:*:*","range":[{"introduced":"1.9.8"},{"last_affected":"1.9.8"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.9.9"},{"last_affected":"1.9.9"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.9:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.9.10"},{"last_affected":"1.9.10"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.10:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.9.11"},{"last_affected":"1.9.11"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.11:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.12:*:*:*:*:*:*:*","range":[{"introduced":"1.9.12"},{"last_affected":"1.9.12"}]},{"range":[{"introduced":"1.9.13"},{"last_affected":"1.9.13"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.13:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.14:*:*:*:*:*:*:*","range":[{"introduced":"1.9.14"},{"last_affected":"1.9.14"}]},{"range":[{"introduced":"1.9.15"},{"last_affected":"1.9.15"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.15:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.9.16"},{"last_affected":"1.9.16"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.16:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.17:*:*:*:*:*:*:*","range":[{"introduced":"1.9.17"},{"last_affected":"1.9.17"}]},{"range":[{"introduced":"1.9.18"},{"last_affected":"1.9.18"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.9.18:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.10.0:*:*:*:*:*:*:*","range":[{"introduced":"1.10.0"},{"last_affected":"1.10.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.10.1:*:*:*:*:*:*:*","range":[{"introduced":"1.10.1"},{"last_affected":"1.10.1"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.10.2"},{"last_affected":"1.10.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.10.2:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.10.3"},{"last_affected":"1.10.3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.10.3:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.10.4:*:*:*:*:*:*:*","range":[{"introduced":"1.10.4"},{"last_affected":"1.10.4"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.10.5:*:*:*:*:*:*:*","range":[{"introduced":"1.10.5"},{"last_affected":"1.10.5"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.10.6:*:*:*:*:*:*:*","range":[{"introduced":"1.10.6"},{"last_affected":"1.10.6"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.10.7:*:*:*:*:*:*:*","range":[{"introduced":"1.10.7"},{"last_affected":"1.10.7"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.10.8:*:*:*:*:*:*:*","range":[{"introduced":"1.10.8"},{"last_affected":"1.10.8"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.10.9:*:*:*:*:*:*:*","range":[{"introduced":"1.10.9"},{"last_affected":"1.10.9"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.10.11"},{"last_affected":"1.10.11"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.10.11:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.10.12:*:*:*:*:*:*:*","range":[{"introduced":"1.10.12"},{"last_affected":"1.10.12"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.10.13:*:*:*:*:*:*:*","range":[{"introduced":"1.10.13"},{"last_affected":"1.10.13"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.10.14:*:*:*:*:*:*:*","range":[{"introduced":"1.10.14"},{"last_affected":"1.10.14"}]},{"range":[{"introduced":"1.10.15"},{"last_affected":"1.10.15"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.10.15:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.11.0"},{"last_affected":"1.11.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.11.1"},{"last_affected":"1.11.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.1:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.11.2"},{"last_affected":"1.11.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.2:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.3:*:*:*:*:*:*:*","range":[{"introduced":"1.11.3"},{"last_affected":"1.11.3"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.4:*:*:*:*:*:*:*","range":[{"introduced":"1.11.4"},{"last_affected":"1.11.4"}]},{"range":[{"introduced":"1.11.5"},{"last_affected":"1.11.5"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.5:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.11.6"},{"last_affected":"1.11.6"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.6:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.7:*:*:*:*:*:*:*","range":[{"introduced":"1.11.7"},{"last_affected":"1.11.7"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.8:*:*:*:*:*:*:*","range":[{"introduced":"1.11.8"},{"last_affected":"1.11.8"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.9:*:*:*:*:*:*:*","range":[{"introduced":"1.11.9"},{"last_affected":"1.11.9"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.10:*:*:*:*:*:*:*","range":[{"introduced":"1.11.10"},{"last_affected":"1.11.10"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.11:*:*:*:*:*:*:*","range":[{"introduced":"1.11.11"},{"last_affected":"1.11.11"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.12:*:*:*:*:*:*:*","range":[{"introduced":"1.11.12"},{"last_affected":"1.11.12"}]},{"range":[{"introduced":"1.11.13"},{"last_affected":"1.11.13"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.13:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.14:*:*:*:*:*:*:*","range":[{"introduced":"1.11.14"},{"last_affected":"1.11.14"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.15:*:*:*:*:*:*:*","range":[{"introduced":"1.11.15"},{"last_affected":"1.11.15"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.16:*:*:*:*:*:*:*","range":[{"introduced":"1.11.16"},{"last_affected":"1.11.16"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.11.17"},{"last_affected":"1.11.17"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.17:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.18:*:*:*:*:*:*:*","range":[{"introduced":"1.11.18"},{"last_affected":"1.11.18"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.19:*:*:*:*:*:*:*","range":[{"introduced":"1.11.19"},{"last_affected":"1.11.19"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.20:*:*:*:*:*:*:*","range":[{"introduced":"1.11.20"},{"last_affected":"1.11.20"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.21:*:*:*:*:*:*:*","range":[{"introduced":"1.11.21"},{"last_affected":"1.11.21"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.23:*:*:*:*:*:*:*","range":[{"introduced":"1.11.23"},{"last_affected":"1.11.23"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.24:*:*:*:*:*:*:*","range":[{"introduced":"1.11.24"},{"last_affected":"1.11.24"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.25:*:*:*:*:*:*:*","range":[{"introduced":"1.11.25"},{"last_affected":"1.11.25"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.11.26"},{"last_affected":"1.11.26"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.26:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.11.27"},{"last_affected":"1.11.27"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.27:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.28:*:*:*:*:*:*:*","range":[{"introduced":"1.11.28"},{"last_affected":"1.11.28"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.29:*:*:*:*:*:*:*","range":[{"introduced":"1.11.29"},{"last_affected":"1.11.29"}]},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.30:*:*:*:*:*:*:*","range":[{"introduced":"1.11.30"},{"last_affected":"1.11.30"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:botan_project:botan:1.11.31:*:*:*:*:*:*:*","range":[{"introduced":"1.11.31"},{"last_affected":"1.11.31"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.11.32"},{"last_affected":"1.11.32"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.32:*:*:*:*:*:*:*"},{"range":[{"introduced":"1.11.33"},{"last_affected":"1.11.33"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:botan_project:botan:1.11.33:*:*:*:*:*:*:*"},{"range":[{"fixed":"987ad747db6d0d7e36f840398f3cf02e2fbfd90f"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["1.10.0","1.10.1","1.10.11","1.10.12","1.10.13","1.10.14","1.10.15","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.1","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.19","1.11.2","1.11.20","1.11.21","1.11.23","1.11.24","1.11.25","1.11.26","1.11.27","1.11.28","1.11.29","1.11.3","1.11.30","1.11.31","1.11.32","1.11.33","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.8.0","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.9.0","1.9.1","1.9.10","1.9.11","1.9.12","1.9.13","1.9.14","1.9.15","1.9.16","1.9.17","1.9.18","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9132.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}