PT-2016-3450 · Gnu+4 · Glibc+4

Florian Weimer · Published 2016-04-28 · Updated 2024-06-15 · CVE-2016-10739

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions glibc versions through 2.28

Description The issue is related to insufficient input validation in the getaddrinfo function of the GNU C Library. This could allow an attacker to access confidential data, compromise data integrity, and cause a denial of service. The getaddrinfo function can parse a string containing an IPv4 address followed by whitespace and arbitrary characters, potentially leading applications to incorrectly assume a valid string has been parsed.

Recommendations For versions through 2.28, consider updating to a version where this issue is fixed, as the current version allows for potential exploitation due to the lack of proper input validation in the getaddrinfo function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-3114

BDU:2023-07719

CESA-2019_2118

CESA-2019_3513

CVE-2016-10739

OPENSUSE-SU-2019:1250-1

OPENSUSE-SU-2019_1250-1

OPENSUSE-SU-2024:10792-1

RHSA-2019:2118

RHSA-2019:3513

RHSA-2019_2118

RHSA-2019_3513

SUSE-SU-2019:0903-1

SUSE-SU-2019:1102-1

SUSE-SU-2023:0015-1

SUSE-SU-2023_0015-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Glibc

References · 116

• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10739 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-10739 · Vendor Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=20018 · Patch
• https://ubuntu.com/security/CVE-2016-10739 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05821 · Security Note
• https://access.redhat.com/errata/RHSA-2019:3513 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1250-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0015-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01066 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-10739 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00082.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10739 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10792-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00682 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9192 · Security Note