CVE-2016-9841

zlib: Out-of-bounds pointer arithmetic in inffast.c

Published May 23, 2017 CVSS 3.1 · 9.8 Critical EPSS 7.5% KEV · Not listed
Description
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-1725-1 rsync security update
Debian DLA Debian DLA DLA-2085-1 zlib security update
Ubuntu USN Ubuntu USN USN-4246-1 zlib vulnerabilities
Ubuntu USN Ubuntu USN USN-4292-1 rsync vulnerabilities
Ubuntu USN Ubuntu USN USN-6736-1 klibc vulnerabilities
Ubuntu USN Ubuntu USN USN-6736-2 klibc vulnerabilities
References
Link Providers
http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2016/12/05/21 cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html cve-icon cve-icon
http://www.securityfocus.com/bid/95131 cve-icon cve-icon
http://www.securitytracker.com/id/1039427 cve-icon cve-icon
http://www.securitytracker.com/id/1039596 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1220 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1221 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1222 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2999 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3046 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3047 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3453 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=1402346 cve-icon cve-icon
https://cert-portal.siemens.com/productcert/html/ssa-470355.html cve-icon
https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit#heading=h.t13tvnx4loq7 cve-icon
https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2016-9841 cve-icon
https://security.gentoo.org/glsa/201701-56 cve-icon cve-icon
https://security.gentoo.org/glsa/202007-54 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20171019-0001/ cve-icon cve-icon
https://support.apple.com/HT208112 cve-icon cve-icon
https://support.apple.com/HT208113 cve-icon cve-icon
https://support.apple.com/HT208115 cve-icon cve-icon
https://support.apple.com/HT208144 cve-icon cve-icon
https://usn.ubuntu.com/4246-1/ cve-icon cve-icon
https://usn.ubuntu.com/4292-1/ cve-icon cve-icon
https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib cve-icon cve-icon
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2016-9841 cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
microfocus
Published
Updated
Oct 8, 2026, 9:13 PM
Reserved
Dec 5, 2016, 12:00 AM
Status
Modified
Published
May 23, 2017, 4:29 AM
Modified
Oct 8, 2026, 10:16 PM
Severity
Low
Public date
Sep 22, 2016, 12:00 AM