CVE-2016-9841 - 漏洞详情

CVE-2016-9841 (CNNVD-201612-752)

CRITICAL

中文标题:

zlib 数字错误漏洞

英文标题:

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by levera...

CVSS分数: 9.8

发布时间: 2017-05-23 03:56:00

漏洞类型: 数字错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

zlib是一个供其他应用程序使用的压缩库，它能够提供数据压缩/解压例程。 zlib 1.2.8版本中的inffast.c文件存在数字错误漏洞。攻击者可利用该漏洞造成拒绝服务（应用程序崩溃）。

英文描述:

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

CWE类型:

（暂无数据）

受影响产品

厂商	产品	版本	版本范围	平台	CPE
zlib	zlib	*	-	-	`cpe:2.3:a:zlib:zlib::::::::`
opensuse	leap	42.1	-	-	`cpe:2.3:o:opensuse:leap:42.1:::::::*`
opensuse	leap	42.2	-	-	`cpe:2.3:o:opensuse:leap:42.2:::::::*`
opensuse	opensuse	13.2	-	-	`cpe:2.3:o:opensuse:opensuse:13.2:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
canonical	ubuntu_linux	16.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::`
canonical	ubuntu_linux	18.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::`
oracle	database_server	18c	-	-	`cpe:2.3:a:oracle:database_server:18c:::::::*`
oracle	jdk	1.6.0	-	-	`cpe:2.3:a:oracle:jdk:1.6.0:update161::::::`
oracle	jdk	1.7.0	-	-	`cpe:2.3:a:oracle:jdk:1.7.0:update151::::::`
oracle	jdk	1.8.0	-	-	`cpe:2.3:a:oracle:jdk:1.8.0:update144::::::`
oracle	jre	1.6.0	-	-	`cpe:2.3:a:oracle:jre:1.6.0:update161::::::`
oracle	jre	1.7.0	-	-	`cpe:2.3:a:oracle:jre:1.7.0:update151::::::`
oracle	jre	1.8.0	-	-	`cpe:2.3:a:oracle:jre:1.8.0:update144::::::`
oracle	mysql	*	-	-	`cpe:2.3:a:oracle:mysql::::::::`
redhat	satellite	5.8	-	-	`cpe:2.3:a:redhat:satellite:5.8:::::::*`
redhat	enterprise_linux_desktop	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*`
redhat	enterprise_linux_desktop	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*`
redhat	enterprise_linux_eus	7.4	-	-	`cpe:2.3:o:redhat:enterprise_linux_eus:7.4:::::::*`
redhat	enterprise_linux_eus	7.5	-	-	`cpe:2.3:o:redhat:enterprise_linux_eus:7.5:::::::*`
redhat	enterprise_linux_server	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*`
redhat	enterprise_linux_server	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*`
redhat	enterprise_linux_workstation	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*`
redhat	enterprise_linux_workstation	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*`
apple	iphone_os	*	-	-	`cpe:2.3:o:apple:iphone_os::::::::`
apple	mac_os_x	*	-	-	`cpe:2.3:o:apple:mac_os_x::::::::`
apple	tvos	*	-	-	`cpe:2.3:o:apple:tvos::::::::`
apple	watchos	*	-	-	`cpe:2.3:o:apple:watchos::::::::`
netapp	active_iq_unified_manager	*	-	-	`cpe:2.3:a:netapp:active_iq_unified_manager::::::windows::*`
netapp	cloud_backup	-	-	-	`cpe:2.3:a:netapp:cloud_backup:-:::::::*`
netapp	e-series_santricity_management	-	-	-	`cpe:2.3:a:netapp:e-series_santricity_management:-:::::vmware_sra::`
netapp	e-series_santricity_os_controller	*	-	-	`cpe:2.3:a:netapp:e-series_santricity_os_controller::::::::`
netapp	e-series_santricity_storage_manager	-	-	-	`cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:::::::*`
netapp	e-series_santricity_web_services	-	-	-	`cpe:2.3:a:netapp:e-series_santricity_web_services:-:::::web_services_proxy::`
netapp	oncommand_balance	-	-	-	`cpe:2.3:a:netapp:oncommand_balance:-:::::::*`
netapp	oncommand_insight	-	-	-	`cpe:2.3:a:netapp:oncommand_insight:-:::::::*`
netapp	oncommand_performance_manager	-	-	-	`cpe:2.3:a:netapp:oncommand_performance_manager:-:::::vmware_vsphere::`
netapp	oncommand_shift	-	-	-	`cpe:2.3:a:netapp:oncommand_shift:-:::::::*`
netapp	oncommand_unified_manager	*	-	-	`cpe:2.3:a:netapp:oncommand_unified_manager::::::vsphere::*`
netapp	oncommand_unified_manager	-	-	-	`cpe:2.3:a:netapp:oncommand_unified_manager:-:::::7-mode::`
netapp	oncommand_workflow_automation	-	-	-	`cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*`
netapp	snapmanager	-	-	-	`cpe:2.3:a:netapp:snapmanager:-:::::oracle::`
netapp	solidfire	-	-	-	`cpe:2.3:a:netapp:solidfire:-:::::::*`
netapp	steelstore_cloud_integrated_storage	-	-	-	`cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*`
netapp	storage_replication_adapter_for_clustered_data_ontap	-	-	-	`cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:-:::::vmware_vsphere::`
netapp	symantec_netbackup	-	-	-	`cpe:2.3:a:netapp:symantec_netbackup:-:::::::*`
netapp	vasa_provider_for_clustered_data_ontap	*	-	-	`cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap::::::::`
netapp	virtual_storage_console	-	-	-	`cpe:2.3:a:netapp:virtual_storage_console:-:::::vmware_vsphere::`
netapp	hci_storage_node	-	-	-	`cpe:2.3:h:netapp:hci_storage_node:-:::::::*`
nodejs	node.js	*	-	-	`cpe:2.3:a:nodejs:node.js:::::-:::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

RHSA-2017:1221 vendor-advisory
cve.org

访问

RHSA-2017:1220 vendor-advisory
cve.org

访问

RHSA-2017:3047 vendor-advisory
cve.org

访问

[oss-security] 20161205 Re: CVE Request: zlib security issues found during audit mailing-list
cve.org

访问

95131 vdb-entry
cve.org

访问

RHSA-2017:3046 vendor-advisory
cve.org

访问

openSUSE-SU-2017:0077 vendor-advisory
cve.org

访问

1039596 vdb-entry
cve.org

访问

GLSA-201701-56 vendor-advisory
cve.org

访问

1039427 vdb-entry
cve.org

访问

RHSA-2017:1222 vendor-advisory
cve.org

访问

openSUSE-SU-2017:0080 vendor-advisory
cve.org

访问

RHSA-2017:3453 vendor-advisory
cve.org

访问

openSUSE-SU-2016:3202 vendor-advisory
cve.org

访问

RHSA-2017:2999 vendor-advisory
cve.org

访问

[debian-lts-announce] 20190324 [SECURITY] [DLA 1725-1] rsync security update mailing-list
cve.org

访问

USN-4246-1 vendor-advisory
cve.org

访问

[debian-lts-announce] 20200129 [SECURITY] [DLA 2085-1] zlib security update mailing-list
cve.org

访问

USN-4292-1 vendor-advisory
cve.org

访问