CVE-2016-9843 The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
CriticalCVSS 9.8
EPSS 5.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/rsync(Debian:12) | < 3.1.3-6 | 3.1.3-6 |
| debian/rsync(Debian:13) | < 3.1.3-6 | 3.1.3-6 |
| debian/rsync(Debian:14) | < 3.1.3-6 | 3.1.3-6 |
| debian/zlib(Debian:12) | < 1:1.2.8.dfsg-3 | 1:1.2.8.dfsg-3 |
| debian/zlib(Debian:13) | < 1:1.2.8.dfsg-3 | 1:1.2.8.dfsg-3 |
| debian/zlib(Debian:14) | < 1:1.2.8.dfsg-3 | 1:1.2.8.dfsg-3 |
| zlib | >= 1.2.0, < 1.2.9 | 1.2.9 |
| openSUSE leap | = 42.1 | No fix listed |
| openSUSE leap | = 42.2 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| oracle database server | = 18c | No fix listed |
| oracle jdk | = 1.6.0-update161 | No fix listed |
| oracle jdk | = 1.7.0-update151 | No fix listed |
| oracle jdk | = 1.8.0-update144 | No fix listed |
| oracle jre | = 1.6.0-update161 | No fix listed |
| oracle jre | = 1.7.0-update151 | No fix listed |
| oracle jre | = 1.8.0-update144 | No fix listed |
| oracle MySQL | >= 5.5.0, <= 5.5.61 | No fix listed |
| oracle MySQL | >= 5.6.0, <= 5.6.41 | No fix listed |
| oracle MySQL | >= 5.7.0, <= 5.7.23 | No fix listed |
| oracle MySQL | >= 8.0.0, <= 8.0.12 | No fix listed |
| redhat satellite | = 5.8 | No fix listed |
Show 59 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| apple iphone os | < 11 | 11 |
| apple mac os x | >= 10.0.0, < 10.13.0 | 10.13.0 |
| apple tvOS | < 11.0 | 11.0 |
| apple watchOS | < 4 | 4 |
| netapp active iq unified manager | >= 7.3 | No fix listed |
| netapp active iq unified manager | >= 9.5 | No fix listed |
| netapp oncommand insight | All versions | No fix listed |
| netapp oncommand workflow automation | All versions | No fix listed |
| netapp snapcenter | All versions | No fix listed |
| MariaDB Server | >= 5.5.0, < 5.5.62 | 5.5.62 |
| MariaDB Server | >= 10.0.0, < 10.0.37 | 10.0.37 |
| MariaDB Server | >= 10.1.0, < 10.1.37 | 10.1.37 |
| MariaDB Server | >= 10.2.0, < 10.2.19 | 10.2.19 |
| MariaDB Server | >= 10.3.0, < 10.3.11 | 10.3.11 |
| nodejs node.js | >= 4.0.0, <= 4.1.2 | No fix listed |
| nodejs node.js | >= 4.2.0, < 4.8.2 | 4.8.2 |
| nodejs node.js | >= 6.0.0, <= 6.8.1 | No fix listed |
| nodejs node.js | >= 6.9.0, < 6.10.2 | 6.10.2 |
| nodejs node.js | >= 7.0.0, < 7.6.0 | 7.6.0 |
| alpine/mariadb(Alpine:v3.10) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.11) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.12) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.13) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.14) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.15) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.16) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.17) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.18) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.19) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.20) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.21) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.22) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.23) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.24) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/mariadb(Alpine:v3.6) | >= 5.5.0, < 10.1.37-r0 | 10.1.37-r0 |
| alpine/mariadb(Alpine:v3.7) | >= 5.5.0, < 10.1.37-r0 | 10.1.37-r0 |
| alpine/mariadb(Alpine:v3.8) | >= 5.5.0, < 10.2.19-r0 | 10.2.19-r0 |
| alpine/mariadb(Alpine:v3.9) | >= 5.5.0, < 10.3.11-r0 | 10.3.11-r0 |
| alpine/perl(Alpine:v3.5) | < 5.24.3-r1 | 5.24.3-r1 |
| alpine/perl(Alpine:v3.6) | < 5.24.3-r1 | 5.24.3-r1 |
| alpine/zlib(Alpine:v3.3) | >= 1.2.0, < 1.2.11-r0 | 1.2.11-r0 |
| alpine/zlib(Alpine:v3.4) | >= 1.2.0, < 1.2.11-r0 | 1.2.11-r0 |
| alpine/zlib(Alpine:v3.5) | >= 1.2.0, < 1.2.11-r0 | 1.2.11-r0 |
| ubuntu/klibc(Ubuntu:24.04) | < 2.0.13-4ubuntu0.2 | 2.0.13-4ubuntu0.2 |
| ubuntu/zsync(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/klibc(Ubuntu:26.04) | < 2.0.14-1ubuntu2 | 2.0.14-1ubuntu2 |
| ubuntu/zsync(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/klibc(Ubuntu:26.10) | < 2.0.14-1ubuntu2 | 2.0.14-1ubuntu2 |
| ubuntu/zsync(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/klibc(Ubuntu:22.04) | < 2.0.10-4ubuntu0.2 | 2.0.10-4ubuntu0.2 |
| ubuntu/zsync(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-4246-1 vendor-advisory
- USN-4292-1 vendor-advisory
- USN-7959-1 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2016-9843 vendor-advisory
- openSUSE-SU-2016:3202 vendor-advisory
- openSUSE-SU-2017:0077 vendor-advisory
- openSUSE-SU-2017:0080 vendor-advisory
- [oss-security] 20161205 Re: CVE Request: zlib security issues found during audit mailing-list
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 95131 vdb-entry
- 1039427 vdb-entry
- 1041888 vdb-entry
- RHSA-2017:1220 vendor-advisory
- RHSA-2017:1221 vendor-advisory
- RHSA-2017:1222 vendor-advisory
- RHSA-2017:2999 vendor-advisory
- RHSA-2017:3046 vendor-advisory
- RHSA-2017:3047 vendor-advisory
- RHSA-2017:3453 vendor-advisory
- bugzilla.redhat.com
- github.com
- [debian-lts-announce] 20190324 [SECURITY] [DLA 1725-1] rsync security update mailing-list
- [debian-lts-announce] 20200129 [SECURITY] [DLA 2085-1] zlib security update mailing-list
- GLSA-201701-56 vendor-advisory
- GLSA-202007-54 vendor-advisory
- security.netapp.com
- support.apple.com
- support.apple.com
- support.apple.com
- support.apple.com
- USN-4246-1 vendor-advisory
- USN-4292-1 vendor-advisory
- wiki.mozilla.org
- wiki.mozilla.org
- www.oracle.com
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking