{"id":"CVE-2016-9132","details":"In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.","modified":"2026-07-08T05:48:42.287429675Z","published":"2017-01-30T22:59:00.827Z","related":["SUSE-SU-2017:1222-1","SUSE-SU-2017:1305-1","SUSE-SU-2017:1351-1","openSUSE-SU-2024:10594-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"botan_project:botan","cpes":["cpe:2.3:a:botan_project:botan:1.10.10:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.10.10"},{"last_affected":"1.10.10"}]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OUDGVRQYQUL7F5MRP3LAV7EHRJG4BBE/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2Y3JLMTE3VIV4X5X6SXVZTJBDDLCS3D/"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/95879"},{"type":"FIX","url":"https://github.com/randombit/botan/commit/987ad747db6d0d7e36f840398f3cf02e2fbfd90f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/randombit/botan","events":[{"introduced":"5de3c5deb3ef63e1759bdf73337ffb45e063dd9c"},{"last_affected":"560c0e5623cd9ef704b06c56b7e827e7431ae1a8"},{"fixed":"987ad747db6d0d7e36f840398f3cf02e2fbfd90f"}],"database_specific":{"cpe":["cpe:2.3:a:botan_project:botan:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.2:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.3:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.4:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.5:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.6:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.7:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.8:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.9:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.10:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.11:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.12:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.13:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.14:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.8.15:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.0:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.2:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.3:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.4:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.5:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.6:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.7:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.8:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.9:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.10:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.11:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.12:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.14:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.15:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.16:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.17:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.9.18:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.0:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.1:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.2:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.3:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.4:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.5:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.6:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.7:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.8:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.9:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.11:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.12:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.13:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.14:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.10.15:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.0:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.1:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.2:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.3:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.4:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.5:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.6:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.7:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.8:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.9:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.10:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.11:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.12:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.13:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.14:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.15:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.16:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.17:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.18:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.19:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.20:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.21:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.23:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.24:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.25:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.26:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.27:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.28:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.29:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.30:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.31:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.32:*:*:*:*:*:*:*","cpe:2.3:a:botan_project:botan:1.11.33:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.8.0"},{"last_affected":"1.8.0"},{"introduced":"1.8.1"},{"last_affected":"1.8.1"},{"introduced":"1.8.2"},{"last_affected":"1.8.2"},{"introduced":"1.8.3"},{"last_affected":"1.8.3"},{"introduced":"1.8.4"},{"last_affected":"1.8.4"},{"introduced":"1.8.5"},{"last_affected":"1.8.5"},{"introduced":"1.8.6"},{"last_affected":"1.8.6"},{"introduced":"1.8.7"},{"last_affected":"1.8.7"},{"introduced":"1.8.8"},{"last_affected":"1.8.8"},{"introduced":"1.8.9"},{"last_affected":"1.8.9"},{"introduced":"1.8.10"},{"last_affected":"1.8.10"},{"introduced":"1.8.11"},{"last_affected":"1.8.11"},{"introduced":"1.8.12"},{"last_affected":"1.8.12"},{"introduced":"1.8.13"},{"last_affected":"1.8.13"},{"introduced":"1.8.14"},{"last_affected":"1.8.14"},{"introduced":"1.8.15"},{"last_affected":"1.8.15"},{"introduced":"1.9.0"},{"last_affected":"1.9.0"},{"introduced":"1.9.1"},{"last_affected":"1.9.1"},{"introduced":"1.9.2"},{"last_affected":"1.9.2"},{"introduced":"1.9.3"},{"last_affected":"1.9.3"},{"introduced":"1.9.4"},{"last_affected":"1.9.4"},{"introduced":"1.9.5"},{"last_affected":"1.9.5"},{"introduced":"1.9.6"},{"last_affected":"1.9.6"},{"introduced":"1.9.7"},{"last_affected":"1.9.7"},{"introduced":"1.9.8"},{"last_affected":"1.9.8"},{"introduced":"1.9.9"},{"last_affected":"1.9.9"},{"introduced":"1.9.10"},{"last_affected":"1.9.10"},{"introduced":"1.9.11"},{"last_affected":"1.9.11"},{"introduced":"1.9.12"},{"last_affected":"1.9.12"},{"introduced":"1.9.13"},{"last_affected":"1.9.13"},{"introduced":"1.9.14"},{"last_affected":"1.9.14"},{"introduced":"1.9.15"},{"last_affected":"1.9.15"},{"introduced":"1.9.16"},{"last_affected":"1.9.16"},{"introduced":"1.9.17"},{"last_affected":"1.9.17"},{"introduced":"1.9.18"},{"last_affected":"1.9.18"},{"introduced":"1.10.0"},{"last_affected":"1.10.0"},{"introduced":"1.10.1"},{"last_affected":"1.10.1"},{"introduced":"1.10.2"},{"last_affected":"1.10.2"},{"introduced":"1.10.3"},{"last_affected":"1.10.3"},{"introduced":"1.10.4"},{"last_affected":"1.10.4"},{"introduced":"1.10.5"},{"last_affected":"1.10.5"},{"introduced":"1.10.6"},{"last_affected":"1.10.6"},{"introduced":"1.10.7"},{"last_affected":"1.10.7"},{"introduced":"1.10.8"},{"last_affected":"1.10.8"},{"introduced":"1.10.9"},{"last_affected":"1.10.9"},{"introduced":"1.10.11"},{"last_affected":"1.10.11"},{"introduced":"1.10.12"},{"last_affected":"1.10.12"},{"introduced":"1.10.13"},{"last_affected":"1.10.13"},{"introduced":"1.10.14"},{"last_affected":"1.10.14"},{"introduced":"1.10.15"},{"last_affected":"1.10.15"},{"introduced":"1.11.0"},{"last_affected":"1.11.0"},{"introduced":"1.11.1"},{"last_affected":"1.11.1"},{"introduced":"1.11.2"},{"last_affected":"1.11.2"},{"introduced":"1.11.3"},{"last_affected":"1.11.3"},{"introduced":"1.11.4"},{"last_affected":"1.11.4"},{"introduced":"1.11.5"},{"last_affected":"1.11.5"},{"introduced":"1.11.6"},{"last_affected":"1.11.6"},{"introduced":"1.11.7"},{"last_affected":"1.11.7"},{"introduced":"1.11.8"},{"last_affected":"1.11.8"},{"introduced":"1.11.9"},{"last_affected":"1.11.9"},{"introduced":"1.11.10"},{"last_affected":"1.11.10"},{"introduced":"1.11.11"},{"last_affected":"1.11.11"},{"introduced":"1.11.12"},{"last_affected":"1.11.12"},{"introduced":"1.11.13"},{"last_affected":"1.11.13"},{"introduced":"1.11.14"},{"last_affected":"1.11.14"},{"introduced":"1.11.15"},{"last_affected":"1.11.15"},{"introduced":"1.11.16"},{"last_affected":"1.11.16"},{"introduced":"1.11.17"},{"last_affected":"1.11.17"},{"introduced":"1.11.18"},{"last_affected":"1.11.18"},{"introduced":"1.11.19"},{"last_affected":"1.11.19"},{"introduced":"1.11.20"},{"last_affected":"1.11.20"},{"introduced":"1.11.21"},{"last_affected":"1.11.21"},{"introduced":"1.11.23"},{"last_affected":"1.11.23"},{"introduced":"1.11.24"},{"last_affected":"1.11.24"},{"introduced":"1.11.25"},{"last_affected":"1.11.25"},{"introduced":"1.11.26"},{"last_affected":"1.11.26"},{"introduced":"1.11.27"},{"last_affected":"1.11.27"},{"introduced":"1.11.28"},{"last_affected":"1.11.28"},{"introduced":"1.11.29"},{"last_affected":"1.11.29"},{"introduced":"1.11.30"},{"last_affected":"1.11.30"},{"introduced":"1.11.31"},{"last_affected":"1.11.31"},{"introduced":"1.11.32"},{"last_affected":"1.11.32"},{"introduced":"1.11.33"},{"last_affected":"1.11.33"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.10.0","1.10.1","1.10.11","1.10.12","1.10.13","1.10.14","1.10.15","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.1","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.19","1.11.2","1.11.20","1.11.21","1.11.23","1.11.24","1.11.25","1.11.26","1.11.27","1.11.28","1.11.29","1.11.3","1.11.30","1.11.31","1.11.32","1.11.33","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.8.0","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.9.0","1.9.1","1.9.10","1.9.11","1.9.12","1.9.13","1.9.14","1.9.15","1.9.16","1.9.17","1.9.18","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9132.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}