vulnwire
9.8crit

CVE-2016-8704in critical feed

An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memca…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
23.2%
percentile 98%
Public exploits
0
none known

An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Exploit prediction (EPSS)

23.17% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Memcached Memcached

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

  • security.gentoo.org /glsa/201701-12 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • debian.org /security/2016/dsa-3704 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2819.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/94083 · vdb-entry, x_refsource_BID, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2820.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:0059 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securitytracker.com /id/1037333 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • talosintelligence.com /reports/TALOS-2016-0219/ · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.