CVE-2016-6313

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.

• CWE-200

• http://rhn.redhat.com/errata/RHSA-2016-2674.html
• http://www.debian.org/security/2016/dsa-3649Third Party Advisory
• http://www.debian.org/security/2016/dsa-3650Third Party Advisory
• http://www.securityfocus.com/bid/92527Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036635
• http://www.ubuntu.com/usn/USN-3064-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-3065-1Third Party Advisory
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS
• https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.htmlMailing List, Vendor Advisory
• https://security.gentoo.org/glsa/201610-04
• https://security.gentoo.org/glsa/201612-01
• http://rhn.redhat.com/errata/RHSA-2016-2674.html
• http://www.debian.org/security/2016/dsa-3649Third Party Advisory
• http://www.debian.org/security/2016/dsa-3650Third Party Advisory
• http://www.securityfocus.com/bid/92527Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036635
• http://www.ubuntu.com/usn/USN-3064-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-3065-1Third Party Advisory
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS
• https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.htmlMailing List, Vendor Advisory
• https://security.gentoo.org/glsa/201610-04
• https://security.gentoo.org/glsa/201612-01

Published

Dec 13, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6307The state-machine implementation in OpenSSL 1.1.0 before 1.1…
• CVE-2016-6308statem/statem_dtls.c in the DTLS implementation in OpenSSL 1…
• CVE-2016-6309statem/statem.c in OpenSSL 1.1.0a does not consider memory-b…
• CVE-2016-6310oVirt Engine discloses the ENGINE_HTTPS_PKI_TRUST_STORE_PASS…
• CVE-2016-6311Get requests in JBoss Enterprise Application Platform (EAP) …
• CVE-2016-6312The mod_dontdothat component of the mod_dav_svn Apache modul…
• CVE-2016-6314Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-6315Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-6316Cross-site scripting (XSS) vulnerability in Action View in R…
• CVE-2016-6317Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not…
• CVE-2016-6318Stack-based buffer overflow in the FascistGecosUser function…7.8
• CVE-2016-6319Cross-site scripting (XSS) vulnerability in app/helpers/form…