CVE-2016-9840 inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
HighCVSS 8.8
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/klibc(Ubuntu:22.04) | < 2.0.10-4ubuntu0.1 | 2.0.10-4ubuntu0.1 |
| ubuntu/zsync(Ubuntu:22.04) | All versions | No fix listed |
| debian/rsync(Debian:12) | < 3.1.3-6 | 3.1.3-6 |
| debian/rsync(Debian:13) | < 3.1.3-6 | 3.1.3-6 |
| debian/rsync(Debian:14) | < 3.1.3-6 | 3.1.3-6 |
| debian/zlib(Debian:12) | < 1:1.2.8.dfsg-3 | 1:1.2.8.dfsg-3 |
| debian/zlib(Debian:13) | < 1:1.2.8.dfsg-3 | 1:1.2.8.dfsg-3 |
| debian/zlib(Debian:14) | < 1:1.2.8.dfsg-3 | 1:1.2.8.dfsg-3 |
| alpine/perl(Alpine:v3.5) | < 5.24.3-r1 | 5.24.3-r1 |
| alpine/perl(Alpine:v3.6) | < 5.24.3-r1 | 5.24.3-r1 |
| alpine/zlib(Alpine:v3.3) | >= 1.2.0.6, < 1.2.11-r0 | 1.2.11-r0 |
| alpine/zlib(Alpine:v3.4) | >= 1.2.0.6, < 1.2.11-r0 | 1.2.11-r0 |
| alpine/zlib(Alpine:v3.5) | >= 1.2.0.6, < 1.2.11-r0 | 1.2.11-r0 |
| ubuntu/klibc(Ubuntu:24.04) | < 2.0.13-4ubuntu0.1 | 2.0.13-4ubuntu0.1 |
| ubuntu/zsync(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/zsync(Ubuntu:26.04) | All versions | No fix listed |
| Siemens CADRA | < V2511 | V2511 |
| ubuntu/zsync(Ubuntu:26.10) | All versions | No fix listed |
| boost | < 1.78.0 | 1.78.0 |
| zlib | >= 1.2.0.6, < 1.2.9 | 1.2.9 |
| openSUSE leap | = 42.1 | No fix listed |
| openSUSE leap | = 42.2 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
Show 30 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| oracle database server | = 18c | No fix listed |
| oracle jdk | = 1.6.0-update161 | No fix listed |
| oracle jdk | = 1.7.0-update151 | No fix listed |
| oracle jdk | = 1.8.0-update144 | No fix listed |
| oracle jre | = 1.6.0-update161 | No fix listed |
| oracle jre | = 1.7.0-update151 | No fix listed |
| oracle jre | = 1.8.0-update144 | No fix listed |
| oracle MySQL | >= 5.5.0, <= 5.5.61 | No fix listed |
| oracle MySQL | >= 5.6.0, <= 5.6.41 | No fix listed |
| oracle MySQL | >= 5.7.0, <= 5.7.23 | No fix listed |
| oracle MySQL | >= 8.0.0, <= 8.0.12 | No fix listed |
| redhat satellite | = 5.8 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| apple iphone os | < 11 | 11 |
| apple mac os x | >= 10.0.0, < 10.13.0 | 10.13.0 |
| apple tvOS | < 11.0 | 11.0 |
| apple watchOS | < 4 | 4 |
| nodejs node.js | >= 4.0.0, <= 4.1.2 | No fix listed |
| nodejs node.js | >= 4.2.0, < 4.8.2 | 4.8.2 |
| nodejs node.js | >= 6.0.0, <= 6.8.1 | No fix listed |
| nodejs node.js | >= 6.9.0, < 6.10.2 | 6.10.2 |
| nodejs node.js | >= 7.0.0, < 7.6.0 | 7.6.0 |
References
- Ubuntu CVE tracker vendor-advisory
- USN-4246-1 vendor-advisory
- USN-4292-1 vendor-advisory
- USN-6736-1 vendor-advisory
- USN-6736-2 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2016-9840 vendor-advisory
- security.alpinelinux.org vendor-advisory
- RHSA-2017:1221 third-party-advisory vendor-advisory
- RHSA-2017:1220 third-party-advisory vendor-advisory
- RHSA-2017:3047 third-party-advisory vendor-advisory
- [oss-security] 20161205 Re: CVE Request: zlib security issues found during audit mailing-list third-party-advisory
- 95131 broken-link vdb-entry
- RHSA-2017:3046 third-party-advisory vendor-advisory
- openSUSE-SU-2017:0077 third-party-advisory vendor-advisory
- GLSA-201701-56 third-party-advisory vendor-advisory
- 1039427 broken-link vdb-entry
- RHSA-2017:1222 third-party-advisory vendor-advisory
- openSUSE-SU-2017:0080 third-party-advisory vendor-advisory
- RHSA-2017:3453 third-party-advisory vendor-advisory
- openSUSE-SU-2016:3202 third-party-advisory vendor-advisory
- RHSA-2017:2999 third-party-advisory vendor-advisory
- [debian-lts-announce] 20190324 [SECURITY] [DLA 1725-1] rsync security update mailing-list third-party-advisory
- USN-4246-1 third-party-advisory vendor-advisory
- [debian-lts-announce] 20200129 [SECURITY] [DLA 2085-1] zlib security update mailing-list third-party-advisory
- USN-4292-1 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- support.apple.com third-party-advisory
- github.com patch third-party-advisory
- wiki.mozilla.org third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- wiki.mozilla.org broken-link
- GLSA-202007-54 third-party-advisory vendor-advisory
- cert-portal.siemens.com
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking