CVE-2016-9888 An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause...
MediumCVSS 5.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libgsf(Debian:12) | < 1.14.41-1 | 1.14.41-1 |
| debian/libgsf(Debian:13) | < 1.14.41-1 | 1.14.41-1 |
| debian/libgsf(Debian:14) | < 1.14.41-1 | 1.14.41-1 |
| GNOME libgsf | <= 1.14.40 | No fix listed |
| alpine/libgsf(Alpine:v3.10) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.11) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.12) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.13) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.14) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.15) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.16) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.17) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.18) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.19) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.2) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.20) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.21) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.22) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.23) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.24) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.3) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.4) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.5) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.6) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.7) | < 1.14.41-r0 | 1.14.41-r0 |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/libgsf(Alpine:v3.8) | < 1.14.41-r0 | 1.14.41-r0 |
| alpine/libgsf(Alpine:v3.9) | < 1.14.41-r0 | 1.14.41-r0 |
References
- Debian Security Tracker CVE-2016-9888 vendor-advisory
- 94860 vdb-entry
- github.com patch vendor-advisory
- [debian-lts-announce] 20200425 [SECURITY] [DLA 2183-1] libgsf security update mailing-list
- secunia.com permissions-required third-party-advisory
- secunia.com permissions-required third-party-advisory
- security.alpinelinux.org vendor-advisory