PT-2017-9757 · R Development Core Team+2 · R+2

Cory Duplantis · Published 2017-03-10 · Updated 2022-12-14 · CVE-2016-8714

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions R version 3.3.0

Description A buffer overflow issue exists in the LoadEncoding functionality. This can be triggered by a specially crafted R script, causing a buffer overflow that results in memory corruption. An attacker can exploit this by sending a malicious R script.

Recommendations For R version 3.3.0, consider disabling the LoadEncoding functionality as a temporary workaround until a patch is available. Restrict access to executing R scripts from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALT-PU-2017-1642

CVE-2016-8714

DLA-861-1

DSA-3813-1

MGASA-2017-0236

USN-4799-1

Affected Products

Alt Linux

R

Ubuntu

References · 17

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0227 · Exploit
• https://osv.dev/vulnerability/CVE-2016-8714 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-8714 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8714 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8714 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-8714 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0236 · Vendor Advisory
• http://debian.org/security/2017/dsa-3813 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3813-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-3813 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8714 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4799-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8714 · Security Note
• https://ubuntu.com/security/notices/USN-4799-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0236.html · Security Note