CVE-2016-9843
CRITICAL EPSS 92.4%
Published May 23, 20179y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Published May 23, 2017 9y ago
Last Modified Jun 17, 2026 2w ago
Description
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
92.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Affected Products 46
| Vendor | Product | Version | Range |
|---|---|---|---|
| zlib | zlib | * | ≥1.2.0 – <1.2.9 |
| opensuse | leap | 42.1 | any |
| opensuse | leap | 42.2 | any |
| opensuse | opensuse | 13.2 | any |
| debian | debian_linux | 8.0 | any |
| canonical | ubuntu_linux | 16.04 | any |
| canonical | ubuntu_linux | 18.04 | any |
| oracle | database_server | 18c | any |
| oracle | jdk | 1.6.0 | any |
| oracle | jdk | 1.7.0 | any |
| oracle | jdk | 1.8.0 | any |
| oracle | jre | 1.6.0 | any |
| oracle | jre | 1.7.0 | any |
| oracle | jre | 1.8.0 | any |
| oracle | mysql | * | ≥5.5.0 – ≤5.5.61 |
| oracle | mysql | * | ≥5.6.0 – ≤5.6.41 |
| oracle | mysql | * | ≥5.7.0 – ≤5.7.23 |
| oracle | mysql | * | ≥8.0.0 – ≤8.0.12 |
| redhat | satellite | 5.8 | any |
| redhat | enterprise_linux_desktop | 6.0 | any |
| redhat | enterprise_linux_desktop | 7.0 | any |
| redhat | enterprise_linux_eus | 7.4 | any |
| redhat | enterprise_linux_eus | 7.5 | any |
| redhat | enterprise_linux_server | 6.0 | any |
| redhat | enterprise_linux_server | 7.0 | any |
| redhat | enterprise_linux_workstation | 6.0 | any |
| redhat | enterprise_linux_workstation | 7.0 | any |
| apple | iphone_os | * | <11 |
| apple | mac_os_x | * | ≥10.0.0 – <10.13.0 |
| apple | tvos | * | <11.0 |
| apple | watchos | * | <4 |
| netapp | active_iq_unified_manager | * | ≥7.3 |
| netapp | active_iq_unified_manager | * | ≥9.5 |
| netapp | oncommand_insight | * | any |
| netapp | oncommand_workflow_automation | * | any |
| netapp | snapcenter | * | any |
| mariadb | mariadb | * | ≥5.5.0 – <5.5.62 |
| mariadb | mariadb | * | ≥10.0.0 – <10.0.37 |
| mariadb | mariadb | * | ≥10.1.0 – <10.1.37 |
| mariadb | mariadb | * | ≥10.2.0 – <10.2.19 |
| mariadb | mariadb | * | ≥10.3.0 – <10.3.11 |
| nodejs | node.js | * | ≥4.0.0 – ≤4.1.2 |
| nodejs | node.js | * | ≥4.2.0 – <4.8.2 |
| nodejs | node.js | * | ≥6.0.0 – ≤6.8.1 |
| nodejs | node.js | * | ≥6.9.0 – <6.10.2 |
| nodejs | node.js | * | ≥7.0.0 – <7.6.0 |
References 33
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html
- openwall.com http://www.openwall.com/lists/oss-security/2016/12/05/21
- oracle.com http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- oracle.com http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- oracle.com http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- securityfocus.com http://www.securityfocus.com/bid/95131
- securitytracker.com http://www.securitytracker.com/id/1039427
- securitytracker.com http://www.securitytracker.com/id/1041888
- access.redhat.com https://access.redhat.com/errata/RHSA-2017:1220
- access.redhat.com https://access.redhat.com/errata/RHSA-2017:1221
- access.redhat.com https://access.redhat.com/errata/RHSA-2017:1222
- access.redhat.com https://access.redhat.com/errata/RHSA-2017:2999
- access.redhat.com https://access.redhat.com/errata/RHSA-2017:3046
- access.redhat.com https://access.redhat.com/errata/RHSA-2017:3047
- access.redhat.com https://access.redhat.com/errata/RHSA-2017:3453
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1402351
- github.com https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811
- lists.debian.org https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html
- security.gentoo.org https://security.gentoo.org/glsa/201701-56
- security.gentoo.org https://security.gentoo.org/glsa/202007-54
- security.netapp.com https://security.netapp.com/advisory/ntap-20181018-0002/
- support.apple.com https://support.apple.com/HT208112
- support.apple.com https://support.apple.com/HT208113
- support.apple.com https://support.apple.com/HT208115
- support.apple.com https://support.apple.com/HT208144
- usn.ubuntu.com https://usn.ubuntu.com/4246-1/
- usn.ubuntu.com https://usn.ubuntu.com/4292-1/
- wiki.mozilla.org https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib
- wiki.mozilla.org https://wiki.mozilla.org/images/0/09/Zlib-report.pdf
- oracle.com https://www.oracle.com/security-alerts/cpujul2020.html
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.