CVE catalog

CVE-2016-9132

Botan-2.18.1-1.3 on GA media

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.32% · Oct 25, 2026

In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntubotan1.10pro1.10.5-1vulnerable
Ubuntubotan1.10pro1.10.5-1ubuntu1vulnerable
Ubuntubotan1.10pro1.10.5-1+deb7u1ubuntu0.14.04.1vulnerable
Ubuntubotan1.10pro1.10.5-1+deb7u1ubuntu0.14.04.1+esm1fixed
Ubuntubotan1.1016.041.10.10-6vulnerable
Ubuntubotan1.1016.041.10.12-1vulnerable
Debianbotan1.1071.10.5-1vulnerable
Debianbotan1.1071.10.5-1+deb7u1vulnerable
Debianbotan1.1071.10.5-1+deb7u2fixed
OpensuseBotantumbleweed2.18.1-1.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntubotan1.10debpro1.10.5-1+deb7u1ubuntu0.14.04.1+esm1Not reportedUBUNTU-CVE-2016-9132Not reported
Debianbotan1.10deb71.10.5-1+deb7u2Not reportedDLA-786-1Not reported
OpensuseBotanrpmtumbleweed2.18.1-1.3Not reportedOPENSUSE-SU-2024:10594-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[openSUSE Tumbleweed]

  • [Botan]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · x86_64 · tumbleweed

      Fixed · Fixed: 2.18.1-1.3

      pypi · Botan · opensuse · tumbleweed

  • [Botan-doc]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · noarch · tumbleweed

      Unknown · Fixed: 2.18.1-1.3

      Version impact unknown

      pypi · Botan · opensuse · tumbleweed

  • [libbotan-3-11]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 2.18.1-1.3

      Version impact unknown

      pypi · Botan · opensuse · tumbleweed

  • [libbotan-devel]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 2.18.1-1.3

      Version impact unknown

      pypi · Botan · opensuse · tumbleweed

  • [python3-botan]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 2.18.1-1.3

      Version impact unknown

      pypi · Botan · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]