CVE-2016-9842

Description

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

8.8

CVSS

Severity: High

CVSS 3.1 •

CVSS 2.0 •

EPSS 10.32% Top 10%

Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory gentoo.org

Affected: n/a n/a

References

Link	Tags
https://access.redhat.com/errata/RHSA-2017:1221	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2017:1220	third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2017:3047	third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2016/12/05/21	mailing list patch
http://www.securityfocus.com/bid/95131	vdb entry third party advisory broken link
https://access.redhat.com/errata/RHSA-2017:3046	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html	vendor advisory broken link
https://security.gentoo.org/glsa/201701-56	third party advisory vendor advisory
http://www.securitytracker.com/id/1039427	vdb entry third party advisory broken link
https://access.redhat.com/errata/RHSA-2017:1222	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html	vendor advisory broken link
https://access.redhat.com/errata/RHSA-2017:3453	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html	vendor advisory broken link
https://access.redhat.com/errata/RHSA-2017:2999	third party advisory vendor advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html	third party advisory mailing list
https://usn.ubuntu.com/4246-1/	third party advisory vendor advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html	third party advisory mailing list
https://usn.ubuntu.com/4292-1/	third party advisory vendor advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	third party advisory
https://www.oracle.com/security-alerts/cpujul2020.html	third party advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	third party advisory
https://support.apple.com/HT208144	third party advisory
https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib	third party advisory
https://support.apple.com/HT208113	third party advisory
https://support.apple.com/HT208112	third party advisory
https://support.apple.com/HT208115	third party advisory
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf	third party advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1402348	issue tracking patch
https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958	patch
https://security.gentoo.org/glsa/202007-54	third party advisory vendor advisory

Frequently Asked Questions

What is the severity of CVE-2016-9842?: CVE-2016-9842 has been scored as a high severity vulnerability.
How to fix CVE-2016-9842?: To fix CVE-2016-9842, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2016-9842 being actively exploited in the wild?: It is possible that CVE-2016-9842 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~10% probability that this vulnerability will be exploited by malicious actors in the next 30 days.