CVE-2016-10196: Buffer Overflow
A vulnerability was found in libevent. There is a stack-buffer overflow in evutil.c.
Upstream bug:
https://github.com/libevent/libevent/issues/318
Upstream patch:
https://github.com/libevent/libevent/commit/329acc18a0768c21ba22522f01a5c7f46cacc4d5
Other sources
Stack-based buffer overflow in the evutilparsesockaddrport function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ipasstring argument.
— Launchpad
Three vulnerabilities were reported in the Libevent library that allow for out-of-bounds reads and denial of service (DoS) attacks. These were fixed in the Libevent library and these changes were ported to Mozilla code.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5433
- CVE-2017-5435
- CVE-2017-5436
- CVE-2017-5461
- CVE-2017-5459
- CVE-2017-5466
- CVE-2017-5434
- CVE-2017-5432
- CVE-2017-5460
- CVE-2017-5438
- CVE-2017-5439
- CVE-2017-5440
- CVE-2017-5441
- CVE-2017-5442
- CVE-2017-5464
- CVE-2017-5443
- CVE-2017-5444
- CVE-2017-5446
- CVE-2017-5447
- CVE-2017-5465
- CVE-2016-10196
- CVE-2017-5454
- CVE-2017-5469
- CVE-2017-5445
- CVE-2017-5449
- CVE-2017-5451
- CVE-2017-5462
- CVE-2017-5467
- CVE-2017-5430
- CVE-2017-5429
- CVE-2017-5448
- CVE-2017-5455
- CVE-2017-5456
- CVE-2017-5450
- CVE-2017-5463
- CVE-2017-5452
- CVE-2017-5453
- CVE-2017-5458
- CVE-2017-5468
Frequently Asked Questions
What is the severity of CVE-2016-10196?
CVE-2016-10196 is classified as a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2016-10196?
To fix CVE-2016-10196, upgrade libevent to version 2.1.12-stable-10 or later.
Which software is affected by CVE-2016-10196?
CVE-2016-10196 affects Mozilla Firefox, Firefox ESR, Mozilla Thunderbird, and libevent versions up to 2.1.5.
What type of vulnerability is CVE-2016-10196?
CVE-2016-10196 is a stack-buffer overflow vulnerability occurring in the evutil.c file of libevent.
Is there an exploitation risk associated with CVE-2016-10196?
Yes, CVE-2016-10196 poses a significant risk of exploitation by attackers to execute arbitrary code.