Candidate: CVE-2016-7420
PublicDate: 2016-09-16 05:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7420
 https://github.com/weidai11/cryptopp/issues/277
 http://www.openwall.com/lists/oss-security/2016/09/15/12
 http://www.openwall.com/lists/oss-security/2016/09/16/1
 https://github.com/weidai11/cryptopp/commit/553049ba297d89d9e8fbf2204acb40a8a53f5cd6
Description:
 Crypto++ (aka cryptopp) through 5.6.4 does not document the requirement for
 a compile-time NDEBUG definition disabling the many assert calls that are
 unintended in production use, which might allow context-dependent attackers
 to obtain sensitive information by leveraging access to process memory
 after an assertion failure, as demonstrated by reading a core dump.
Ubuntu-Description:
Notes:
 ratliff> precise, trusty, xenial, yakkety all build using -NDEBUG
 msalvatore> I'm retiring this CVE and marking each release as "ignored". I've
             confirmed ratliff's above comment. In addition, the fix for this
             CVE is simply an update to the documentation.
Bugs:
Priority: negligible
Discovered-by: 
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N [5.9 MEDIUM]

Patches_libcrypto++:
upstream_libcrypto++: released (5.6.5)
precise_libcrypto++: ignored (reached end-of-life)
precise/esm_libcrypto++: DNE (precise was needed)
trusty_libcrypto++: ignored (compiled with -NDEBUG)
trusty/esm_libcrypto++: ignored (compiled with -NDEBUG)
vivid/stable-phone-overlay_libcrypto++: DNE
vivid/ubuntu-core_libcrypto++: DNE
xenial_libcrypto++: ignored (compiled with -NDEBUG)
yakkety_libcrypto++: ignored (reached end-of-life)
zesty_libcrypto++: ignored (reached end-of-life)
artful_libcrypto++: ignored (reached end-of-life)
bionic_libcrypto++: ignored (compiled with -NDEBUG)
devel_libcrypto++: ignored (compiled with -NDEBUG)