# OpenSSL Advisory: Sept 26th 2016

OpenSSL have published a [security advisory](https://www.openssl.org/news/secadv/20160926.txt). Here's how it affects BoringSSL:

CVE | Summary | [Severity] in OpenSSL | Impact to BoringSSL
----|---------|-----------------------|---------------------
CVE-2016-6309 | Use After Free for large message sizes. | Critical | Not affected. The code in question was not included in BoringSSL. We’ll add a test anyway.
CVE-2016-7052 | Crash when using CRLs | High | Affected. Fix was imported. See discussion below.

[Severity]: https://openssl-library.org/policies/general/security-policy/index.html#issue-severity

## CVE-2016-7052

This bug causes a NULL pointer deref in some cases while processing a CRL. We imported the affected code in [e76cdde7](https://boringssl.googlesource.com/boringssl/+/e76cdde77d05e13c4743ce1b5fe102cb4dd30e03) (July 26th) so it has been in BoringSSL for some months. The fix was imported in [f9f312a](https://boringssl.googlesource.com/boringssl/+/f9f312af61f9ba87896736620d1e4e568c4442bd).
