9.8
CVSSv3

CVE-2016-9843

Published: 23/05/2017 Updated: 07/11/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent malicious users to have unspecified impact via vectors involving big-endian CRC calculation.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

zlib zlib

opensuse leap 42.2

opensuse leap 42.1

opensuse opensuse 13.2

debian debian linux 8.0

canonical ubuntu linux 18.04

canonical ubuntu linux 16.04

oracle mysql

oracle database server 18c

oracle jdk 1.8.0

oracle jdk 1.7.0

oracle jdk 1.6.0

oracle jre 1.6.0

oracle jre 1.8.0

oracle jre 1.7.0

redhat enterprise linux desktop 7.0

redhat enterprise linux workstation 7.0

redhat enterprise linux server 7.0

redhat enterprise linux desktop 6.0

redhat enterprise linux server 6.0

redhat enterprise linux workstation 6.0

redhat enterprise linux eus 7.4

redhat enterprise linux eus 7.5

redhat satellite 5.8

apple tvos

apple iphone os

apple watchos

apple mac os x

netapp snapcenter -

netapp oncommand workflow automation -

netapp oncommand insight -

netapp active iq unified manager

mariadb mariadb

nodejs node.js

Vendor Advisories

Several security issues were fixed in zlib ...
Several security issues were fixed in rsync ...
Synopsis Critical: java-180-oracle security update Type/Severity Security Advisory: Critical Topic An update for java-180-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a secur ...
Synopsis Important: java-170-oracle security update Type/Severity Security Advisory: Important Topic An update for java-170-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a sec ...
Synopsis Moderate: java-160-ibm security update Type/Severity Security Advisory: Moderate Topic An update for java-160-ibm is now available for Red Hat Enterprise Linux 6 SupplementaryRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring ...
Synopsis Moderate: java-180-ibm security update Type/Severity Security Advisory: Moderate Topic An update for java-180-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 SupplementaryRed Hat Product Security has rated this update as having a security impact ...
Synopsis Important: java-180-ibm security update Type/Severity Security Advisory: Important Topic An update for java-180-ibm is now available for Red Hat Satellite 58 and Red Hat Satellite 58 ELSRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerab ...
Synopsis Moderate: java-171-ibm security update Type/Severity Security Advisory: Moderate Topic An update for java-171-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 SupplementaryRed Hat Product Security has rated this update as having a security impact ...
Synopsis Important: java-160-sun security update Type/Severity Security Advisory: Important Topic An update for java-160-sun is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security ...
Debian Bug report logs - #911221 mysql-57: Security fixes from the October 2018 CPU Package: src:mysql-57; Maintainer for src:mysql-57 is Debian MySQL Maintainers <pkg-mysql-maint@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 17 Oct 2018 09:15:02 UTC Severity: grave Tag ...
Debian Bug report logs - #847275 zlib: CVE-2016-9843 Package: src:zlib; Maintainer for src:zlib is Mark Brown <broonie@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 6 Dec 2016 21:06:02 UTC Severity: important Tags: patch, security, upstream Found in version zlib/1:128dfsg-2 Fixed ...
Debian Bug report logs - #847270 zlib: CVE-2016-9840 CVE-2016-9841: out-of-bounds pointer Package: src:zlib; Maintainer for src:zlib is Mark Brown <broonie@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 6 Dec 2016 20:45:01 UTC Severity: important Tags: patch, security, upstream Found ...
Debian Bug report logs - #847274 zlib: CVE-2016-9842 Package: src:zlib; Maintainer for src:zlib is Mark Brown <broonie@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 6 Dec 2016 21:03:01 UTC Severity: important Tags: patch, security, upstream Found in version zlib/1:128dfsg-2 Fixed ...
The crc32_big function in crc32c in zlib 128 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation(CVE-2016-9843) Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Storage Engines) Supported versions that are affected are 5561 and prior, 5641 and ...
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Supported versions that are affected are 5561 and prior, 5641 and prior, 5723 and prior and 8012 and prior Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise ...
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Supported versions that are affected are 5641 and prior, 5723 and prior and 8012 and prior Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server Successful attacks of this vulner ...
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Supported versions that are affected are 5723 and prior and 8012 and prior Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server While the vulnerability is in MySQL Server, ...
The crc32_big function in crc32c in zlib 128 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation ...

Github Repositories

singularity container tools for continuous integration and quality assessment

Singularity Container Tools These are tools for Singularity containers, optimized for using with continuous integration for security and quality checks For an example of the package being used in a continuous integration context, see the stools-clair repository In this work we will use Clair OS combined with Continuous Integration (travis and circle) to scan Singularity con

Paclair is a Python3 Cli tool to interact with Coreos's Clair (https://github.com/coreos/clair).

Paclair Paclair is a Python3 Cli tool to interact with Coreos's Clair Features: Now compatible with Clair V3 (delete is not available) No need to have docker installed since Paclair interacts directly with the registries Compatible with all registries Simple to use Easy integration in a CI job thanks to a lightweight output mode Installation To install Paclair, sim

References

NVD-CWE-noinfohttps://access.redhat.com/errata/RHSA-2017:1221https://access.redhat.com/errata/RHSA-2017:1220https://access.redhat.com/errata/RHSA-2017:3047http://www.openwall.com/lists/oss-security/2016/12/05/21http://www.securityfocus.com/bid/95131http://www.securitytracker.com/id/1041888https://access.redhat.com/errata/RHSA-2017:3046http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.htmlhttps://security.gentoo.org/glsa/201701-56http://www.securitytracker.com/id/1039427https://access.redhat.com/errata/RHSA-2017:1222http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.htmlhttps://access.redhat.com/errata/RHSA-2017:3453http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.htmlhttps://access.redhat.com/errata/RHSA-2017:2999https://lists.debian.org/debian-lts-announce/2019/03/msg00027.htmlhttps://usn.ubuntu.com/4246-1/https://lists.debian.org/debian-lts-announce/2020/01/msg00030.htmlhttps://usn.ubuntu.com/4292-1/http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttps://support.apple.com/HT208144https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlibhttps://support.apple.com/HT208113https://support.apple.com/HT208112https://support.apple.com/HT208115https://wiki.mozilla.org/images/0/09/Zlib-report.pdfhttps://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811https://bugzilla.redhat.com/show_bug.cgi?id=1402351https://security.netapp.com/advisory/ntap-20181018-0002/https://security.gentoo.org/glsa/202007-54https://nvd.nist.govhttps://usn.ubuntu.com/4246-1/