PT-2016-3851 · Redis+1 · Redis+1
Kaeso
+1
·
Published
2015-12-03
·
Updated
2026-05-18
·
CVE-2015-8080
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions 2.8.x through 2.8.23
Redis versions 3.0.x through 3.0.5
Description
The issue is related to an integer overflow in the getnum function in lua struct.c. This allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service, including memory corruption and application crash, or possibly bypass intended sandbox restrictions. The attack is triggered by a large number, which causes a stack-based buffer overflow.
Recommendations
For Redis versions 2.8.x through 2.8.23, update to version 2.8.24 or later.
For Redis versions 3.0.x through 3.0.5, update to version 3.0.6 or later.
Exploit
Fix
DoS
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Redis