vulnwire
9.8crit

CVE-2016-9841in critical feed

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Published 9 y ago · modified 29 d ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
7.5%
percentile 95%
Public exploits
0
none known

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
29 d ago

Exploit prediction (EPSS)

7.55% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Siemens CADRA

Classification

Technology feeds
Node.js (RSS, critical only) · MySQL (RSS, critical only) · Oracle Database (RSS, critical only)

References

  • access.redhat.com /errata/RHSA-2017:1221 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:1220 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:3047 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • openwall.com /lists/oss-security/2016/12/05/21 · mailing-list, x_refsource_MLIST, x_transferred
  • securityfocus.com /bid/95131 · vdb-entry, x_refsource_BID, x_transferred
  • access.redhat.com /errata/RHSA-2017:3046 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.opensuse.org /opensuse-updates/2017-01/msg00050.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • securitytracker.com /id/1039596 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • security.gentoo.org /glsa/201701-56 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securitytracker.com /id/1039427 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • access.redhat.com /errata/RHSA-2017:1222 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.opensuse.org /opensuse-updates/2017-01/msg00053.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • access.redhat.com /errata/RHSA-2017:3453 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.opensuse.org /opensuse-updates/2016-12/msg00127.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • access.redhat.com /errata/RHSA-2017:2999 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.debian.org /debian-lts-announce/2019/03/msg00027.html · mailing-list, x_refsource_MLIST, x_transferred
  • usn.ubuntu.com /4246-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.debian.org /debian-lts-announce/2020/01/msg00030.html · mailing-list, x_refsource_MLIST, x_transferred
  • usn.ubuntu.com /4292-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2018-4258247.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /security-alerts/cpujul2020.html · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2017-3236626.html · x_refsource_CONFIRM, x_transferred
  • support.apple.com /HT208144 · x_refsource_CONFIRM, x_transferred
  • wiki.mozilla.org /MOSS/Secure_Open_Source/Completed#zlib · x_refsource_MISC, x_transferred
  • support.apple.com /HT208113 · x_refsource_CONFIRM, x_transferred
  • support.apple.com /HT208112 · x_refsource_CONFIRM, x_transferred
  • support.apple.com /HT208115 · x_refsource_CONFIRM, x_transferred
  • wiki.mozilla.org /images/0/09/Zlib-report.pdf · x_refsource_MISC, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=1402346 · x_refsource_CONFIRM, x_transferred
  • github.com /madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb · x_refsource_CONFIRM, x_transferred
  • security.netapp.com /advisory/ntap-20171019-0001/ · x_refsource_CONFIRM, x_transferred
  • security.gentoo.org /glsa/202007-54 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • cert-portal.siemens.com /productcert/html/ssa-470355.html

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.