CVE-2016-9841
Critical
Description
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
SeverityCritical
CVSS9.8
Exploit probability95. percentile7.6%
Product
Zlib
PublishedMay 23, 2017
First seenMay 23, 2017
How to fix
Update
- zlib zlib1.2.9 or later
- apple iphone_os11 or later
- apple mac_os_x10.13.0 or later
- apple tvos11.0 or later
- apple watchos4 or later
- nodejs node.js4.8.2, 6.10.2, 7.6.0 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2017:1221
- access.redhat.com/errata/RHSA-2017:1220
- access.redhat.com/errata/RHSA-2017:3047
- access.redhat.com/errata/RHSA-2017:3046
- security.gentoo.org/glsa/201701-56
- access.redhat.com/errata/RHSA-2017:1222
- access.redhat.com/errata/RHSA-2017:3453
- access.redhat.com/errata/RHSA-2017:2999
- usn.ubuntu.com/4246-1/
- usn.ubuntu.com/4292-1/
- security.gentoo.org/glsa/202007-54
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zlib zlib | 1.2.0 ≤ v < 1.2.9 | 1.2.9 |
| opensuse leap | 42.1, 42.2 | — |
| opensuse opensuse | 13.2 | — |
| debian debian_linux | 8.0 | — |
| canonical ubuntu_linux | 16.04, 18.04 | — |
| oracle database_server | 18c | — |
| oracle jdk | 1.6.0, 1.7.0, 1.8.0 | — |
| oracle jre | 1.6.0, 1.7.0, 1.8.0 | — |
| oracle mysql | 5.5.0 ≤ v ≤ 5.5.61, 5.6.0 ≤ v ≤ 5.6.41, 5.7.0 ≤ v ≤ 5.7.23, 8.0.0 ≤ v ≤ 8.0.12 | — |
| redhat satellite | 5.8 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_eus | 7.4, 7.5 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| apple iphone_os | v < 11 | 11 |
| apple mac_os_x | 10.0.0 ≤ v < 10.13.0 | 10.13.0 |
| apple tvos | v < 11.0 | 11.0 |
| apple watchos | v < 4 | 4 |
| netapp active_iq_unified_manager | 7.3 ≤ v, 9.5 ≤ v | — |
| netapp cloud_backup | No range specified | — |
| netapp e-series_santricity_management | No range specified | — |
| netapp e-series_santricity_os_controller | 11.0.0 ≤ v ≤ 11.70.1 | — |
| netapp e-series_santricity_storage_manager | No range specified | — |
| netapp e-series_santricity_web_services | No range specified | — |
| netapp oncommand_balance | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| netapp oncommand_performance_manager | No range specified | — |
| netapp oncommand_shift | No range specified | — |
| netapp oncommand_unified_manager | v ≤ 7.1, No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp snapmanager | No range specified | — |
| netapp solidfire | No range specified | — |
| netapp steelstore_cloud_integrated_storage | No range specified | — |
| netapp storage_replication_adapter_for_clustered_data_ontap | No range specified | — |
| netapp symantec_netbackup | No range specified | — |
| netapp vasa_provider_for_clustered_data_ontap | 7.2 ≤ v | — |
| netapp virtual_storage_console | No range specified | — |
| netapp hci_storage_node | No range specified | — |
| nodejs node.js | 4.0.0 ≤ v ≤ 4.1.2, 4.2.0 ≤ v < 4.8.2, 6.0.0 ≤ v ≤ 6.8.1, 6.9.0 ≤ v < 6.10.2, 7.0.0 ≤ v < 7.6.0 | 4.8.2, 6.10.2, 7.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.