CVE-2016-9842

high-risk

Published 2017-05-23

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

Do I need to act?

12.1% chance of exploitation in next 30 days

EPSS score — higher than 88% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (20)

Leap

Opensuse

Debian Linux

Ubuntu Linux

Jdk

Jre

Mysql

Satellite

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Workstation

Iphone Os

Mac Os X

Tvos

Watchos

Zlib

Affected Vendors

Canonical Nodejs Redhat Opensuse Oracle Debian Zlib Apple

References (60)

Broken Link http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html

Broken Link http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html

Broken Link http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html

Mailing List http://www.openwall.com/lists/oss-security/2016/12/05/21

Third Party Advisory http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Third Party Advisory http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Broken Link http://www.securityfocus.com/bid/95131

Broken Link http://www.securitytracker.com/id/1039427

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:1220

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:1221

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:1222

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2999

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3046

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3047

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3453

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1402348

Patch https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958

Mailing List https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html

Mailing List https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html

Third Party Advisory https://security.gentoo.org/glsa/201701-56

and 40 more references

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 12/34 · Low

Exposure 22/34 · High