CVE-2015-8080

Published: Apr 13, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.

Affected (9)

Products: Redislabs: Redis · Debian: Debian Linux · Opensuse: Leap, Opensuse · +1 more

Show all products

Redislabs: Redis · Debian: Debian Linux · Opensuse: Leap, Opensuse · Redhat: Openstack

1 product

1 product

2 products

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redislabs Redis	From 2.8.0 to 2.8.24
Redislabs Redis	From 3.0.0 to 3.0.6
Redislabs Redis	From 5.0.0 to 5.0.8

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1
Opensuse Opensuse	Version 13.2

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Openstack	Version 6.0
Redhat Openstack	Version 7.0

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (24)

http://lists.opensuse.org/opensuse-updates/2016-05/msg00126.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0095.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0096.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0097.html

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2015/dsa-3412

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/11/06/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2015/11/06/4

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/77507

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://github.com/antirez/redis/issues/2855

Source: cve@mitre.org

ExploitIssue TrackingPatchThird Party Advisory

https://raw.githubusercontent.com/antirez/redis/2.8/00-RELEASENOTES

Source: cve@mitre.org

Release NotesThird Party Advisory

https://raw.githubusercontent.com/antirez/redis/3.0/00-RELEASENOTES

Source: cve@mitre.org

Release NotesThird Party Advisory

https://security.gentoo.org/glsa/201702-16

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2016-05/msg00126.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0095.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0096.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0097.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2015/dsa-3412

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/11/06/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2015/11/06/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/77507

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://github.com/antirez/redis/issues/2855

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

https://raw.githubusercontent.com/antirez/redis/2.8/00-RELEASENOTES

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://raw.githubusercontent.com/antirez/redis/3.0/00-RELEASENOTES

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://security.gentoo.org/glsa/201702-16

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.