CVE-2016-9840

zlib: Out-of-bound pointer arithmetic in inftrees.c

Published May 23, 2017 CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed
Description
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-1725-1 rsync security update
Debian DLA Debian DLA DLA-2085-1 zlib security update
EUVD EUVD EUVD-2016-10640 inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Ubuntu USN Ubuntu USN USN-4246-1 zlib vulnerabilities
Ubuntu USN Ubuntu USN USN-4292-1 rsync vulnerabilities
Ubuntu USN Ubuntu USN USN-6736-1 klibc vulnerabilities
Ubuntu USN Ubuntu USN USN-6736-2 klibc vulnerabilities
References
Link Providers
http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2016/12/05/21 cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html cve-icon cve-icon
http://www.securityfocus.com/bid/95131 cve-icon cve-icon
http://www.securitytracker.com/id/1039427 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1220 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1221 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1222 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2999 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3046 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3047 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3453 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=1402345 cve-icon cve-icon
https://cert-portal.siemens.com/productcert/html/ssa-470355.html cve-icon
https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit#heading=h.t13tvnx4loq7 cve-icon
https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2016-9840 cve-icon
https://security.gentoo.org/glsa/201701-56 cve-icon cve-icon
https://security.gentoo.org/glsa/202007-54 cve-icon cve-icon
https://support.apple.com/HT208112 cve-icon cve-icon
https://support.apple.com/HT208113 cve-icon cve-icon
https://support.apple.com/HT208115 cve-icon cve-icon
https://support.apple.com/HT208144 cve-icon cve-icon
https://usn.ubuntu.com/4246-1/ cve-icon cve-icon
https://usn.ubuntu.com/4292-1/ cve-icon cve-icon
https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib cve-icon cve-icon
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2016-9840 cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
CPEs cpe:/o:redhat:rhel_aus:8.4
Vendors & Products Redhat rhel Aus
Type Values Removed Values Added
Title zlib: Out-of-bounds pointer arithmetic in inftrees.c zlib: Out-of-bound pointer arithmetic in inftrees.c
Weaknesses CWE-125
Type Values Removed Values Added
First Time appeared Redhat openshift
CPEs cpe:/a:redhat:openshift:4.17::el9
cpe:/a:redhat:openshift:4.18::el9
Vendors & Products Redhat openshift
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux
CPEs cpe:/o:redhat:enterprise_linux:8
Vendors & Products Redhat enterprise Linux
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
First Time appeared Boost
Boost boost
CPEs cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:a:boost:boost:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*
Vendors & Products Boost
Boost boost