CVE-2016-9840
First published: Wed Dec 07 2016(Updated: )
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Credit: CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 security@opentext.com meissner@suse.de
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple macOS High Sierra | <10.13 | 10.13 |
| Apple watchOS | <4 | 4 |
| Apple tvOS | <11 | 11 |
| Apple iOS | <11 | 11 |
| redhat/zlib | <1.2.9 | 1.2.9 |
| Zlib Zlib | >=1.2.0.6<1.2.9 | |
| openSUSE Leap | =42.1 | |
| openSUSE Leap | =42.2 | |
| openSUSE openSUSE | =13.2 | |
| Debian Debian Linux | =8.0 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Oracle Database Server | =18c | |
| Oracle JDK | =1.6.0-update161 | |
| Oracle JDK | =1.7.0-update151 | |
| Oracle JDK | =1.8.0-update144 | |
| Oracle JRE | =1.6.0-update161 | |
| Oracle JRE | =1.7.0-update151 | |
| Oracle JRE | =1.8.0-update144 | |
| Oracle MySQL | >=5.5.0<=5.5.61 | |
| Oracle MySQL | >=5.6.0<=5.6.41 | |
| Oracle MySQL | >=5.7.0<=5.7.23 | |
| Oracle MySQL | >=8.0.0<=8.0.12 | |
| Redhat Satellite | =5.8 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux Desktop | =7.0 | |
| Redhat Enterprise Linux Eus | =7.4 | |
| Redhat Enterprise Linux Eus | =7.5 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Workstation | =6.0 | |
| Redhat Enterprise Linux Workstation | =7.0 | |
| Apple iPhone OS | <11 | |
| Apple Mac OS X | >=10.0.0<10.13.0 | |
| Apple tvOS | <11.0 | |
| Apple watchOS | <4 | |
| Nodejs Node.js | >=4.0.0<=4.1.2 | |
| Nodejs Node.js | >=4.2.0<4.8.2 | |
| Nodejs Node.js | >=6.0.0<=6.8.1 | |
| Nodejs Node.js | >=6.9.0<6.10.2 | |
| Nodejs Node.js | >=7.0.0<7.6.0 | |
| debian/rsync | 3.2.3-4+deb11u1 3.2.7-1 3.3.0-1 | |
| debian/zlib | 1:1.2.11.dfsg-2+deb11u2 1:1.2.13.dfsg-1 1:1.3.dfsg+really1.3.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT208144 (Advisory)
- http://www.openwall.com/lists/oss-security/2016/12/05/21
- https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib
- https://wiki.mozilla.org/images/0/09/Zlib-report.pdf
- https://bugzilla.redhat.com/show_bug.cgi?id=1402345
- https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0
- https://security.gentoo.org/glsa/201701-56
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html
- http://www.securityfocus.com/bid/95131
- http://www.securitytracker.com/id/1039427
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://support.apple.com/HT208112
- https://support.apple.com/HT208113
- https://support.apple.com/HT208115
- https://support.apple.com/HT208144
- https://access.redhat.com/errata/RHSA-2017:3046
- https://access.redhat.com/errata/RHSA-2017:3047
- https://access.redhat.com/errata/RHSA-2017:2999
- https://access.redhat.com/errata/RHSA-2017:3453
- https://access.redhat.com/errata/RHSA-2017:1220
- https://access.redhat.com/errata/RHSA-2017:1221
- https://access.redhat.com/errata/RHSA-2017:1222
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html
- https://usn.ubuntu.com/4246-1/
- https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html
- https://usn.ubuntu.com/4292-1/
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.gentoo.org/glsa/202007-54
- https://launchpad.net/bugs/cve/CVE-2016-9840
- https://support.apple.com/en-us/HT208115 (Advisory)
- https://support.apple.com/en-us/HT208113 (Advisory)
- https://support.apple.com/en-us/HT208112 (Advisory)
- https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit#heading=h.t13tvnx4loq7
- http://seclists.org/oss-sec/2016/q4/602
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1402352
- https://security-tracker.debian.org/tracker/CVE-2016-9840
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9840
- https://nvd.nist.gov/vuln/detail/CVE-2016-9840
- https://ubuntu.com/security/CVE-2016-9840
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2017-13832
- CVE-2016-0736
- CVE-2016-2161
- CVE-2016-5387
- CVE-2016-8740
- CVE-2016-8743
- CVE-2017-13909
- CVE-2017-13809
- CVE-2017-7084
- CVE-2017-7074
- CVE-2017-13820
- CVE-2017-13807
- CVE-2017-7143
- CVE-2017-13829
- CVE-2017-13833
- CVE-2017-7083
- CVE-2017-13821
- CVE-2017-0381
- CVE-2017-13825
- CVE-2017-13890
- CVE-2017-13851
- CVE-2017-7138
- CVE-2017-7121
- CVE-2017-7122
- CVE-2017-7123
- CVE-2017-7124
- CVE-2017-7125
- CVE-2017-7126
- CVE-2017-13815
- CVE-2017-13828
- CVE-2017-13811
- CVE-2017-13835
- CVE-2017-11103
- CVE-2017-13819
- CVE-2017-13830
- CVE-2017-13814
- CVE-2017-13831
- CVE-2017-13837
- CVE-2017-13906
- CVE-2017-7077
- CVE-2017-7119
- CVE-2017-7114
- CVE-2017-13810
- CVE-2017-13817
- CVE-2017-13818
- CVE-2017-13836
- CVE-2017-13841
- CVE-2017-13840
- CVE-2017-13842
- CVE-2017-13782
- CVE-2017-13843
- CVE-2017-13854
- CVE-2017-13834
- CVE-2017-13873
- CVE-2017-13827
- CVE-2017-13813
- CVE-2017-13816
- CVE-2017-13812
- CVE-2016-4736
- CVE-2017-7086
- CVE-2017-1000373
- CVE-2016-9063
- CVE-2017-9233
- CVE-2018-4302
- CVE-2017-5130
- CVE-2017-7376
- CVE-2017-9050
- CVE-2017-9049
- CVE-2017-7141
- CVE-2017-7078
- CVE-2017-6451
- CVE-2017-6452
- CVE-2017-6455
- CVE-2017-6458
- CVE-2017-6459
- CVE-2017-6460
- CVE-2017-6462
- CVE-2017-6463
- CVE-2017-6464
- CVE-2016-9042
- CVE-2017-13824
- CVE-2017-13846
- CVE-2017-10140
- CVE-2017-13822
- CVE-2017-7132
- CVE-2017-13823
- CVE-2017-13808
- CVE-2017-13838
- CVE-2017-7082
- CVE-2017-7080
- CVE-2017-13908
- CVE-2017-13839
- CVE-2017-13910
- CVE-2017-10989
- CVE-2017-7128
- CVE-2017-7129
- CVE-2017-7130
- CVE-2017-7127
- CVE-2016-9840
- CVE-2016-9841
- CVE-2016-9842
- CVE-2016-9843
- CVE-2017-7103
- CVE-2017-7105
- CVE-2017-7108
- CVE-2017-7110
- CVE-2017-7112
- CVE-2017-7116
- CVE-2017-7081
- CVE-2017-7087
- CVE-2017-7091
- CVE-2017-7092
- CVE-2017-7093
- CVE-2017-7094
- CVE-2017-7095
- CVE-2017-7096
- CVE-2017-7098
- CVE-2017-7099
- CVE-2017-7100
- CVE-2017-7102
- CVE-2017-7104
- CVE-2017-7107
- CVE-2017-7111
- CVE-2017-7117
- CVE-2017-7120
- CVE-2017-7090
- CVE-2017-7109
- CVE-2017-11120
- CVE-2017-11121
- CVE-2017-7115
- CVE-2017-11122
- CVE-2017-13863
- CVE-2017-7131
- CVE-2017-7088
- CVE-2017-7072
- CVE-2017-7140
- CVE-2017-7148
- CVE-2017-7097
- CVE-2017-7118
- CVE-2017-7133
- CVE-2017-7075
- CVE-2017-7139
- CVE-2017-13806
- CVE-2017-7085
- CVE-2017-13877
- CVE-2017-7146
- CVE-2017-6211
- CVE-2017-7145
- CVE-2017-7089
- CVE-2017-7106
- CVE-2017-7144
- CVE-2017-7142
- collector/apple-support
- alias/CVE-2016-9841
- alias/CVE-2016-9842
- alias/CVE-2016-9843
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/software-canonical-lookup-request
- agent/author
- agent/severity
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-9840
- agent/software-canonical-lookup
- agent/description
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- agent/references
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/usn-cve
- source/Ubuntu
- vendor/apple
- canonical/apple macos high sierra
- canonical/apple watchos
- canonical/apple tvos
- canonical/apple ios
- package-manager/redhat
- vendor/zlib
- canonical/zlib zlib
- version/zlib zlib/1.2.0.6
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/42.1
- version/opensuse leap/42.2
- canonical/opensuse opensuse
- version/opensuse opensuse/13.2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- vendor/oracle
- canonical/oracle database server
- version/oracle database server/18c
- canonical/oracle jdk
- version/oracle jdk/1.6.0-update161
- version/oracle jdk/1.7.0-update151
- version/oracle jdk/1.8.0-update144
- canonical/oracle jre
- version/oracle jre/1.6.0-update161
- version/oracle jre/1.7.0-update151
- version/oracle jre/1.8.0-update144
- canonical/oracle mysql
- version/oracle mysql/5.5.0
- version/oracle mysql/5.5.61
- version/oracle mysql/5.6.0
- version/oracle mysql/5.6.41
- version/oracle mysql/5.7.0
- version/oracle mysql/5.7.23
- version/oracle mysql/8.0.0
- version/oracle mysql/8.0.12
- vendor/redhat
- canonical/redhat satellite
- version/redhat satellite/5.8
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/6.0
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux eus
- version/redhat enterprise linux eus/7.4
- version/redhat enterprise linux eus/7.5
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0
- version/redhat enterprise linux workstation/7.0
- canonical/apple iphone os
- canonical/apple mac os x
- version/apple mac os x/10.0.0
- vendor/nodejs
- canonical/nodejs node.js
- version/nodejs node.js/4.0.0
- version/nodejs node.js/4.1.2
- version/nodejs node.js/4.2.0
- version/nodejs node.js/6.0.0
- version/nodejs node.js/6.8.1
- version/nodejs node.js/6.9.0
- version/nodejs node.js/7.0.0
- package-manager/debian