PT-2016-7862 · Gnome+2 · Gnome Structured File Library+2

Behzad Najjarpour Jabbari · Published 2016-12-06 · Updated 2024-10-29 · CVE-2016-9888

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNOME Structured File Library versions prior to 1.14.41

Description The issue is related to an error within the tar directory for file() function in the gsf-infile-tar.c file, which can be exploited to trigger a Null pointer dereference, causing a crash when processing a crafted TAR file.

Recommendations For versions prior to 1.14.41, update to version 1.14.41 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted TAR files that could trigger the Null pointer dereference in the tar directory for file() function until a patch is applied.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2016-2417

CVE-2016-9888

DLA-2183-1

DLA-740-1

MGASA-2016-0427

SUSE-SU-2024:3770-1

SUSE-SU-2024_3770-1

Affected Products

Alt Linux

Gnome Structured File Library

Suse

References · 46

• https://github.com/GNOME/libgsf/commit/95a8351a75758cf10b3bf6abae0b6b461f90d9e5 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9888 · Security Note
• https://bdu.fstec.ru/vul/2024-08625 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2016-9888 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/SNGPD6IEEBZDLN6EMGXQ2ATUACQSTOWQ · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-2183-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9888 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9888 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9888 · Security Note
• https://security-tracker.debian.org/tracker/source-package/libgsf · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-2417 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/712776 · Security Note
• https://osv.dev/vulnerability/DLA-2183-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9888 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9888 · Vendor Advisory