CVE-2016-9840

Description

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

8.8

CVSS

Severity: High

CVSS 3.1 •

CVSS 2.0 •

EPSS 12.08% Top 10%

Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory gentoo.org

Affected: n/a n/a

References

Link	Tags
https://access.redhat.com/errata/RHSA-2017:1221	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2017:1220	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2017:3047	third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2016/12/05/21	third party advisory mailing list
http://www.securityfocus.com/bid/95131	vdb entry broken link
https://access.redhat.com/errata/RHSA-2017:3046	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html	third party advisory vendor advisory
https://security.gentoo.org/glsa/201701-56	third party advisory vendor advisory
http://www.securitytracker.com/id/1039427	vdb entry broken link
https://access.redhat.com/errata/RHSA-2017:1222	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2017:3453	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2017:2999	third party advisory vendor advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html	third party advisory mailing list
https://usn.ubuntu.com/4246-1/	third party advisory vendor advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html	third party advisory mailing list
https://usn.ubuntu.com/4292-1/	third party advisory vendor advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	third party advisory
https://www.oracle.com/security-alerts/cpujul2020.html	third party advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	third party advisory
https://support.apple.com/HT208144	third party advisory
https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0	third party advisory patch
https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib	third party advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1402345	third party advisory issue tracking
https://support.apple.com/HT208113	third party advisory
https://support.apple.com/HT208112	third party advisory
https://support.apple.com/HT208115	third party advisory
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf	broken link
https://security.gentoo.org/glsa/202007-54	third party advisory vendor advisory

Frequently Asked Questions

What is the severity of CVE-2016-9840?: CVE-2016-9840 has been scored as a high severity vulnerability.
How to fix CVE-2016-9840?: To fix CVE-2016-9840, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2016-9840 being actively exploited in the wild?: It is possible that CVE-2016-9840 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~12% probability that this vulnerability will be exploited by malicious actors in the next 30 days.