CVE-2016-8339: Buffer Overflow
Published Oct 28, 2016
·Updated
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.
Affected Software
4 affected components
Redislabs Redis=3.2.0
Redislabs Redis=3.2.1
Redislabs Redis=3.2.2
Redislabs Redis=3.2.3
Remediation
Event History
Oct 28, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2016-8339?
CVE-2016-8339 has a critical severity rating due to its potential for arbitrary code execution.
2
How do I fix CVE-2016-8339?
To fix CVE-2016-8339, upgrade Redis to version 3.2.4 or later.
3
What versions of Redis are affected by CVE-2016-8339?
CVE-2016-8339 affects Redis versions 3.2.0 to 3.2.3.
4
What type of vulnerability is CVE-2016-8339?
CVE-2016-8339 is a buffer overflow vulnerability.
5
What conditions lead to exploitation of CVE-2016-8339?
CVE-2016-8339 can be exploited by sending a crafted CONFIG SET command under specific conditions.