CVE-2016-9842

Published: May 23, 2017Modified: Jul 14, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

Affected (36)

Products: Zlib: Zlib · Opensuse: Leap, Opensuse · Debian: Debian Linux · +5 more

Show all products

Zlib: Zlib · Opensuse: Leap, Opensuse · Debian: Debian Linux · Canonical: Ubuntu Linux · Oracle: Database Server, Jdk, Jre, Mysql · Redhat: Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Workstation, Satellite · Apple: Iphone Os, Mac Os X, Tvos, Watchos · Nodejs: Node.js

1 product

2 products

1 product

1 product

4 products

5 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Workstation

4 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zlib Zlib	From 1.2.3.4 to 1.2.9

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1
Opensuse Leap	Version 42.2
Opensuse Opensuse	Version 13.2

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04

Configuration E

11 vulnerable

Vulnerable Software	Affected Versions
Oracle Database Server	Version 18c
Oracle Jdk	Version 1.6.0 update161
Oracle Jdk	Version 1.7.0 update151
Oracle Jdk	Version 1.8.0 update144
Oracle Jre	Version 1.6.0 update161
Oracle Jre	Version 1.7.0 update151
Oracle Jre	Version 1.8.0 update144
Oracle Mysql	From 5.5.0 to 5.5.61
Oracle Mysql	From 5.6.0 to 5.6.41
Oracle Mysql	From 5.7.0 to 5.7.23
Oracle Mysql	From 8.0.0 to 8.0.12

Configuration F

9 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Eus	Version 7.4
Redhat Enterprise Linux Eus	Version 7.5
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0
Redhat Satellite	Version 5.8

Configuration G

4 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Before 11
Apple Mac Os X	From 10.0.0 to 10.13.0
Apple Tvos	Before 11.0
Apple Watchos	Before 4

Configuration H

5 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 4.0.0 to 4.1.2
Nodejs Node.js	From 6.0.0 to 6.8.1
Nodejs Node.js	From 7.0.0 to 7.6.0
Nodejs Node.js	From 4.2.0 to 4.8.2
Nodejs Node.js	From 6.9.0 to 6.10.2

Related CWEs

CWE-1335

Incorrect Bitwise Shift of Integer

An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.

References (61)

http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html

Source: security@opentext.com

Broken Link

http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html

Source: security@opentext.com

Broken Link

http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html

Source: security@opentext.com

Broken Link

http://www.openwall.com/lists/oss-security/2016/12/05/21

Source: security@opentext.com

Mailing ListPatch

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: security@opentext.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: security@opentext.com

Third Party Advisory

http://www.securityfocus.com/bid/95131

Source: security@opentext.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1039427

Source: security@opentext.com

Broken LinkThird Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:1220

Source: security@opentext.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1221

Source: security@opentext.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1222

Source: security@opentext.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2999

Source: security@opentext.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3046

Source: security@opentext.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3047

Source: security@opentext.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3453

Source: security@opentext.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1402348

Source: security@opentext.com

Issue TrackingPatch

https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958

Source: security@opentext.com

Patch

https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html

Source: security@opentext.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html

Source: security@opentext.com

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201701-56

Source: security@opentext.com

Third Party Advisory

https://security.gentoo.org/glsa/202007-54

Source: security@opentext.com

Third Party Advisory

https://support.apple.com/HT208112

Source: security@opentext.com

Third Party Advisory

https://support.apple.com/HT208113

Source: security@opentext.com

Third Party Advisory

https://support.apple.com/HT208115

Source: security@opentext.com

Third Party Advisory

https://support.apple.com/HT208144

Source: security@opentext.com

Third Party Advisory

https://usn.ubuntu.com/4246-1/

Source: security@opentext.com

Third Party Advisory

https://usn.ubuntu.com/4292-1/

Source: security@opentext.com

Third Party Advisory

https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib

Source: security@opentext.com

Third Party Advisory

https://wiki.mozilla.org/images/0/09/Zlib-report.pdf

Source: security@opentext.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: security@opentext.com

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html