Denial of service in Zlib - CVE-2016-9841

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU6664

Denial of service in Zlib - CVE-2016-9841

Published: May 24, 2017 / Updated: February 27, 2025


Vulnerability identifier: #VU6664
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-9841
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in zlib due to out-of-bounds pointer arithmetic in inftrees.c. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Affected software

Zlib
Gentoo Linux
IBM AIX
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
SUSE OpenStack Cloud
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
SUSE Linux
Ubuntu
openEuler
Opensuse
zlib (Ubuntu package)
zlib (Alpine package)
rsync (Ubuntu package)
perl (Alpine package)
libklibc (Ubuntu package)
klibc-utils (Ubuntu package)
java-1.6.0-sun-plugin (Red Hat package)
java-1.6.0-sun-src (Red Hat package)
java-1.6.0-sun-jdbc (Red Hat package)
java-1.6.0-sun-devel (Red Hat package)
java-1.6.0-sun-demo (Red Hat package)
java-1.6.0-sun (Red Hat package)
java-1.7.0-oracle-src (Red Hat package)
java-1.7.0-oracle (Red Hat package)
java-1.7.0-oracle-devel (Red Hat package)
java-1.7.0-oracle-javafx (Red Hat package)
java-1.7.0-oracle-jdbc (Red Hat package)
java-1.7.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-jdbc (Red Hat package)
java-1.8.0-oracle-javafx (Red Hat package)
java-1.8.0-oracle-devel (Red Hat package)
java-1.8.0-oracle (Red Hat package)
java-1.8.0-oracle-src (Red Hat package)
syslinux-debuginfo
syslinux
syslinux-nonlinux
syslinux-tftpboot
syslinux-extlinux-nonlinux
syslinux-perl
syslinux-efi64
syslinux-devel
syslinux-debugsource
syslinux-extlinux
Planning Analytics Local
Red Hat Satellite
IBM MQ
NetWorker
APM Clients
BIG-IQ Centralized Management
IBM Cognos Controller
BIG-IP

How to mitigate CVE-2016-9841

Install update from vendor's website.

Zlib - update to 1.2.9
zlib (Ubuntu package) - update to 1:1.2.8.dfsg-2ubuntu4.3
zlib (Alpine package) - update to 1.2.11-r0
rsync (Ubuntu package) - addressed in versions 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1.1
perl (Alpine package) - update to 5.24.3-r1
libklibc (Ubuntu package) - addressed in versions Ubuntu Pro, 2.0.7-1ubuntu5.2, 2.0.10-4ubuntu0.1, 2.0.13-1ubuntu0.1, 2.0.13-4ubuntu0.1
klibc-utils (Ubuntu package) - addressed in versions Ubuntu Pro, 2.0.7-1ubuntu5.2, 2.0.10-4ubuntu0.1, 2.0.13-1ubuntu0.1, 2.0.13-4ubuntu0.1
java-1.6.0-sun-plugin (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-src (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-jdbc (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-devel (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-demo (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.7.0-oracle-src (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-devel (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-javafx (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-jdbc (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-plugin (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.8.0-oracle-plugin (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-jdbc (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-javafx (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-devel (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-src (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
syslinux-debuginfo - update to 6.04-12
syslinux - update to 6.04-12
syslinux-nonlinux - update to 6.04-12
syslinux-tftpboot - update to 6.04-12
syslinux-extlinux-nonlinux - update to 6.04-12
syslinux-perl - update to 6.04-12
syslinux-efi64 - update to 6.04-12
syslinux-devel - update to 6.04-12
syslinux-debugsource - update to 6.04-12
syslinux-extlinux - update to 6.04-12
NetWorker - update to 19.9.0.1

External References

Related Security Bulletins