CVE-2016-9939

Name	CVE-2016-9939
Description	Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will be zeroed even if its unused. There is a noticeable delay during the wipe for a large allocation.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-766-1, DSA-3748-1
Debian Bugs	848009

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libcrypto++ (PTS)	jessie, jessie (lts)	5.6.1-6+deb8u3	fixed
	stretch	5.6.4-7	fixed
	buster	5.6.4-8	fixed
	bullseye	8.4.0-1	fixed
	bookworm	8.7.0+git220824-1	fixed
	sid, trixie	8.9.0-1.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libcrypto++	source	wheezy	5.6.1-6+deb7u3	DLA-766-1
libcrypto++	source	jessie	5.6.1-6+deb8u3	DSA-3748-1
libcrypto++	source	(unstable)	5.6.4-5		848009

https://github.com/weidai11/cryptopp/issues/346