Unscored severity · published Apr 19, 2012
CVE-2012-2110
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which…
–
CVSS
47.9%
EPSS
No
On KEV
Description
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
Exploitation
Is it being used?
Exploit prediction (EPSS)47.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openssl · Openssl
1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2110
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2110
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.html
cvs.openssl.org
http://cvs.openssl.org/chngview?cn=22431
cvs.openssl.org
http://cvs.openssl.org/chngview?cn=22434
cvs.openssl.org
http://cvs.openssl.org/chngview?cn=22439
lists.apple.com
http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079149.html
More from Openssl
7.5
CVE-2014-0160
OpenSSL Information Disclosure Vulnerability
9.8
CVE-2026-63073
Untrusted Sender DN Used as Format String in CMP Response Validation
9.8
CVE-2026-31789
Heap Buffer Overflow in Hexadecimal Conversion
9.8
CVE-2022-2274
RSA implementation bug in AVX512IFMA instructions
9.8
CVE-2021-3711
SM2 Decryption Buffer Overflow