CVE-2016-9840

high-risk

Published 2017-05-23

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Do I need to act?

13.0% chance of exploitation in next 30 days

EPSS score — higher than 87% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (20)

Leap

Opensuse

Debian Linux

Ubuntu Linux

Jdk

Jre

Mysql

Satellite

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Workstation

Iphone Os

Mac Os X

Tvos

Watchos

Boost

Affected Vendors

Oracle Debian Zlib Opensuse Canonical Nodejs Redhat Boost Apple

References (60)

Third Party Advisory http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html

Third Party Advisory http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html

Third Party Advisory http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html

Mailing List http://www.openwall.com/lists/oss-security/2016/12/05/21

Third Party Advisory http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Third Party Advisory http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Broken Link http://www.securityfocus.com/bid/95131

Broken Link http://www.securitytracker.com/id/1039427

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:1220

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:1221

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:1222

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2999

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3046

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3047

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3453

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1402345

Patch https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0

Mailing List https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html

Mailing List https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html

Third Party Advisory https://security.gentoo.org/glsa/201701-56

and 40 more references

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 12/34 · Low

Exposure 23/34 · High