PT-2017-9847 · None+3 · Musl Libc+4

Rich Felker · Published 2016-11-21 · Updated 2024-10-17 · CVE-2016-8859

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TRE library versions (affected versions not specified) musl libc versions (affected versions not specified)

Description The issue is related to multiple integer overflows in the TRE library and musl libc, which can be exploited by attackers to cause memory corruption. This can be achieved by providing a large number of states or tags, resulting in an out-of-bounds write.

Recommendations For TRE library versions, consider applying configuration changes to limit the number of states or tags that can be processed to prevent memory corruption. For musl libc versions, restrict access to the library to minimize the risk of exploitation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2024-13885

CVE-2016-8859

DLA-687-1

MGASA-2016-0395

OPENSUSE-SU-2020:0554-1

OPENSUSE-SU-2020_0554-1

OPENSUSE-SU-2024:10901-1

OPENSUSE-SU-2024:11475-1

USN-4768-1

Affected Products

Alt Linux

Suse

Tre Library

Ubuntu

Musl Libc

References · 64

• https://osv.dev/vulnerability/openSUSE-SU-2020:0554-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2016-8859 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15650 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8859 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0395 · Vendor Advisory
• https://security.gentoo.org/glsa/202007-43 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-8859 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1817 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6RF7IRNEREOGUAKOAE2LLRIJ37TCLAL4 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8859 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0395.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-8859 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8859 · Vendor Advisory