CVE-2016-9939

Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.

• CWE-20

• http://www.debian.org/security/2016/dsa-3748Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/12/12/7Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/94854Third Party Advisory, VDB Entry
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM/
• http://www.debian.org/security/2016/dsa-3748Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/12/12/7Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/94854Third Party Advisory, VDB Entry
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM/

Published

Jan 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9933Stack consumption vulnerability in the gdImageFillToBorder f…
• CVE-2016-9934ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 a…
• CVE-2016-9935The php_wddx_push_element function in ext/wddx/wddx.c in PHP…
• CVE-2016-9936The unserialize implementation in ext/standard/var.c in PHP …
• CVE-2016-9937An issue was discovered in Asterisk Open Source 13.12.x and …
• CVE-2016-9938An issue was discovered in Asterisk Open Source 11.x before …
• CVE-2016-9941Heap-based buffer overflow in rfbproto.c in LibVNCClient in …
• CVE-2016-9942Heap-based buffer overflow in ultra.c in LibVNCClient in Lib…
• CVE-2016-9949An issue was discovered in Apport before 2.20.4. In apport/u…
• CVE-2016-9950An issue was discovered in Apport before 2.20.4. There is a …
• CVE-2016-9951An issue was discovered in Apport before 2.20.4. A malicious…
• CVE-2016-9952The verify_certificate function in lib/vtls/schannel.c in li…8.1