CVE-2016-5017 Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command stri...
HighCVSS 8.1
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/zookeeper(Debian:12) | < 3.4.9-1 | 3.4.9-1 |
| debian/zookeeper(Debian:13) | < 3.4.9-1 | 3.4.9-1 |
| debian/zookeeper(Debian:14) | < 3.4.9-1 | 3.4.9-1 |
| apache zookeeper | <= 3.4.8 | No fix listed |
| apache zookeeper | = 3.5.0 | No fix listed |
| apache zookeeper | = 3.5.1 | No fix listed |
| apache zookeeper | = 3.5.2 | No fix listed |
References
- Debian Security Tracker CVE-2016-5017 vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- [oss-security] 20160916 [SECURITY] CVE-2016-5017: Buffer overflow vulnerability in ZooKeeper C cli shell mailing-list release-notes third-party-advisory
- 93044 vdb-entry
- git-wip-us.apache.org
- git-wip-us.apache.org
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
- [dubbo-notifications] 20211101 [GitHub] [dubbo] AlbumenJ opened a new issue #9177: Upgrade Zookeeper dependency mailing-list
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list
- www.cloudera.com
- www.oracle.com
- zookeeper.apache.org vendor-advisory