CVE-2016-9842 - 漏洞详情

CVE-2016-9842 (CNNVD-201612-753)

HIGH

中文标题:

zlib 数字错误漏洞

英文标题:

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have ...

CVSS分数: 8.8

发布时间: 2017-05-23 03:56:00

漏洞类型: 数字错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

zlib是一个供其他应用程序使用的压缩库，它能够提供数据压缩/解压例程。 zlib 1.2.8版本中的inflate.c文件的‘inflateMark’函数存在安全漏洞。攻击者可利用该漏洞造成拒绝服务（应用程序崩溃）。

英文描述:

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

CWE类型:

（暂无数据）

受影响产品

厂商	产品	版本	版本范围	平台	CPE
zlib	zlib	*	-	-	`cpe:2.3:a:zlib:zlib::::::::`
opensuse	leap	42.1	-	-	`cpe:2.3:o:opensuse:leap:42.1:::::::*`
opensuse	leap	42.2	-	-	`cpe:2.3:o:opensuse:leap:42.2:::::::*`
opensuse	opensuse	13.2	-	-	`cpe:2.3:o:opensuse:opensuse:13.2:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
canonical	ubuntu_linux	16.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::`
canonical	ubuntu_linux	18.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.04::::esm:::`
oracle	database_server	18c	-	-	`cpe:2.3:a:oracle:database_server:18c:::::::*`
oracle	jdk	1.6.0	-	-	`cpe:2.3:a:oracle:jdk:1.6.0:update161::::::`
oracle	jdk	1.7.0	-	-	`cpe:2.3:a:oracle:jdk:1.7.0:update151::::::`
oracle	jdk	1.8.0	-	-	`cpe:2.3:a:oracle:jdk:1.8.0:update144::::::`
oracle	jre	1.6.0	-	-	`cpe:2.3:a:oracle:jre:1.6.0:update161::::::`
oracle	jre	1.7.0	-	-	`cpe:2.3:a:oracle:jre:1.7.0:update151::::::`
oracle	jre	1.8.0	-	-	`cpe:2.3:a:oracle:jre:1.8.0:update144::::::`
oracle	mysql	*	-	-	`cpe:2.3:a:oracle:mysql::::::::`
redhat	satellite	5.8	-	-	`cpe:2.3:a:redhat:satellite:5.8:::::::*`
redhat	enterprise_linux_desktop	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*`
redhat	enterprise_linux_desktop	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*`
redhat	enterprise_linux_eus	7.4	-	-	`cpe:2.3:o:redhat:enterprise_linux_eus:7.4:::::::*`
redhat	enterprise_linux_eus	7.5	-	-	`cpe:2.3:o:redhat:enterprise_linux_eus:7.5:::::::*`
redhat	enterprise_linux_server	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*`
redhat	enterprise_linux_server	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*`
redhat	enterprise_linux_workstation	6.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*`
redhat	enterprise_linux_workstation	7.0	-	-	`cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*`
apple	iphone_os	*	-	-	`cpe:2.3:o:apple:iphone_os::::::::`
apple	mac_os_x	*	-	-	`cpe:2.3:o:apple:mac_os_x::::::::`
apple	tvos	*	-	-	`cpe:2.3:o:apple:tvos::::::::`
apple	watchos	*	-	-	`cpe:2.3:o:apple:watchos::::::::`
nodejs	node.js	*	-	-	`cpe:2.3:a:nodejs:node.js:::::-:::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

RHSA-2017:1221 vendor-advisory
cve.org

访问

RHSA-2017:1220 vendor-advisory
cve.org

访问

RHSA-2017:3047 vendor-advisory
cve.org

访问

[oss-security] 20161205 Re: CVE Request: zlib security issues found during audit mailing-list
cve.org

访问

95131 vdb-entry
cve.org

访问

RHSA-2017:3046 vendor-advisory
cve.org

访问

openSUSE-SU-2017:0077 vendor-advisory
cve.org

访问

GLSA-201701-56 vendor-advisory
cve.org

访问

1039427 vdb-entry
cve.org

访问

RHSA-2017:1222 vendor-advisory
cve.org

访问

openSUSE-SU-2017:0080 vendor-advisory
cve.org

访问

RHSA-2017:3453 vendor-advisory
cve.org

访问

openSUSE-SU-2016:3202 vendor-advisory
cve.org

访问

RHSA-2017:2999 vendor-advisory
cve.org

访问

[debian-lts-announce] 20190324 [SECURITY] [DLA 1725-1] rsync security update mailing-list
cve.org

访问

USN-4246-1 vendor-advisory
cve.org

访问

[debian-lts-announce] 20200129 [SECURITY] [DLA 2085-1] zlib security update mailing-list
cve.org

访问

USN-4292-1 vendor-advisory
cve.org

访问