PT-2016-7862 · Gnome+2 · Gnome Structured File Library+2

Behzad Najjarpour Jabbari · Publicado 2016-12-06 · Atualizado 2024-10-29 · CVE-2016-9888

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNOME Structured File Library versions prior to 1.14.41

Description The issue is related to an error within the tar directory for file() function in the gsf-infile-tar.c file, which can be exploited to trigger a Null pointer dereference, causing a crash when processing a crafted TAR file.

Recommendations For versions prior to 1.14.41, update to version 1.14.41 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted TAR files that could trigger the Null pointer dereference in the tar directory for file() function until a patch is applied.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2016-2417

CVE-2016-9888

DLA-2183-1

DLA-740-1

MGASA-2016-0427

SUSE-SU-2024:3770-1

SUSE-SU-2024_3770-1

Produtos afetados

Alt Linux

Gnome Structured File Library

Suse

Referências · 46

• https://github.com/GNOME/libgsf/commit/95a8351a75758cf10b3bf6abae0b6b461f90d9e5 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=19932 · Nota
• https://cve.org/CVERecord?id=CVE-2016-9888 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-08625 · Nota de Segurança
• https://osv.dev/vulnerability/ALPINE-CVE-2016-9888 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-9888 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/attachments/20241029/e497797b/attachment.htm · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2024-October/019690.html · Nota
• https://bugzilla.suse.com/show_bug.cgi?id=1014609 · Nota
• https://bugzilla.suse.com/1014609 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/SNGPD6IEEBZDLN6EMGXQ2ATUACQSTOWQ · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-9888.html · Nota
• https://security-tracker.debian.org/tracker/DLA-2183-1 · Aviso do Fabricante
• https://bugzilla.suse.com/show_bug.cgi?id=1231282 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-9888 · Aviso do Fabricante