CVE-2016-7544 Crypto++ 5.6.4 incorrectly uses Microsoft's stack-based _malloca and _freea functions. The library will request a block of memory to align a table in memory. If the table is later reallocated, then th...
HighCVSS 7.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Crypto++ 5.6.4 incorrectly uses Microsoft's stack-based _malloca and _freea functions. The library will request a block of memory to align a table in memory. If the table is later reallocated, then the wrong pointer could be freed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cryptopp crypto++ | = 5.6.4 | No fix listed |
References
- [oss-security] 20160922 CVE Assignment for Crypto++ and "AES and incorrect argument to _freea() under Microsoft compilers" mailing-list patch third-party-advisory
- [oss-security] 20160923 Re: CVE Assignment for Crypto++ and "AES and incorrect argument to _freea() under Microsoft compilers" mailing-list patch third-party-advisory
- 93164 third-party-advisory vdb-entry
- github.com issue-tracking patch third-party-advisory
- www.cryptopp.com release-notes vendor-advisory
- Debian Security Tracker CVE-2016-7544 vendor-advisory