Denial of service in perl (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2016-9842
CWE-ID CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 perl (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Denial of service

EUVDB-ID: #VU6665

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9842

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in zlib due to an undefined left shift of negative number. A remote attacker can send a specially crafted document, trick the victim into opening it, and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

perl (Alpine package): 5.24.3-r0

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=655e1b330491f425fa03eea4ac25bbbf3f29c2df
https://git.alpinelinux.org/aports/commit/?id=7e4d736879a3ca05e4c26194fdfebe0a27b26f9c
https://git.alpinelinux.org/aports/commit/?id=852b09befcff3346184cfa94f712d6a2f85f10f7
https://git.alpinelinux.org/aports/commit/?id=6d398ff0e70f7a9b420319047051b4d7c7e42f17
https://git.alpinelinux.org/aports/commit/?id=7b52a76dd3513db686d4937fbc144f188ef101fa


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###