CVE-2016-7164

Published: Feb 7, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The construct function in puff.cpp in Libtorrent 1.1.0 allows remote torrent trackers to cause a denial of service (segmentation fault and crash) via a crafted GZIP response.

Affected (1)

Products: Libtorrent: Libtorrent

Libtorrent

1 product

Libtorrent

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libtorrent Libtorrent	Version 1.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://www.openwall.com/lists/oss-security/2016/09/08/1

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/09/08/7

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/92891

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://github.com/arvidn/libtorrent/issues/1021

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/arvidn/libtorrent/pull/1022

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/09/08/1