CVE-2016-6306: Canonical Ubuntu Linux

Medium severity, CVSS 5.9. EPSS: 41.7% chance of exploitation in the next 30 days.

The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only
• Debian Debian Linux: version 8.0 only
• HP Icewall Federation Agent: version 3.0 only
• HP Icewall Mcrp: version 3.0 only
• HP Icewall SSO: version 10.0 only
• HP Icewall SSO Agent Option: version 10.0 only
• Node.js Node.js: from 0.10.0, before 0.10.47 (fixed in 0.10.47); from 0.12.0, before 0.12.16 (fixed in 0.12.16); from 4.0.0, up to and including 4.1.2; from 4.2.0, before 4.6.0 (fixed in 4.6.0); from 5.0.0, up to and including 5.12.0; from 6.0.0, before 6.7.0 (fixed in 6.7.0)
• Novell Suse Linux Enterprise Module For Web Scripting: version 12.0 only
• OpenSSL OpenSSL: version 1.0.1 only; version 1.0.1a only; version 1.0.1b only; version 1.0.1c only; version 1.0.1d only; version 1.0.1e only; …

Published 2016-09-26. Last modified 2026-06-17.