CVE-2016-6318 Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field,...
HighCVSS 7.8
EPSS 0.74%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cracklib2(Debian:12) | < 2.9.2-2 | 2.9.2-2 |
| debian/cracklib2(Debian:13) | < 2.9.2-2 | 2.9.2-2 |
| debian/cracklib2(Debian:14) | < 2.9.2-2 | 2.9.2-2 |
| cracklib project cracklib | >= 2.9.0, < 2.9.6 | 2.9.6 |
| openSUSE leap | = 42.1 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| alpine/cracklib(Alpine:v3.10) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.11) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.12) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.13) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.14) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.15) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.16) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.17) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.18) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.19) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.20) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.21) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.22) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.23) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
| alpine/cracklib(Alpine:v3.24) | >= 2.9.0, < 2.9.7-r0 | 2.9.7-r0 |
References
- Debian Security Tracker CVE-2016-6318 vendor-advisory
- openSUSE-SU-2016:2204 mailing-list third-party-advisory vendor-advisory
- [oss-security] 20160816 cracklib: Stack-based buffer overflow when parsing large GECOS field mailing-list third-party-advisory
- 92478 third-party-advisory vdb-entry
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list
- [debian-lts-announce] 20200524 [SECURITY] [DLA 2220-1] cracklib2 security update mailing-list third-party-advisory
- GLSA-201612-25 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking