Denial of service in Zlib - CVE-2016-9842

Vulnerability identifier: #VU6665

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9842

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in zlib due to an undefined left shift of negative number. A remote attacker can send a specially crafted document, trick the victim into opening it, and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Zlib
Gentoo Linux
IBM AIX
SUSE OpenStack Cloud
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
SUSE Linux
openEuler
Opensuse
zlib (Ubuntu package)
zlib (Alpine package)
rsync (Ubuntu package)
perl (Alpine package)
java-1.6.0-sun-demo (Red Hat package)
java-1.6.0-sun (Red Hat package)
java-1.6.0-sun-devel (Red Hat package)
java-1.6.0-sun-jdbc (Red Hat package)
java-1.6.0-sun-plugin (Red Hat package)
java-1.6.0-sun-src (Red Hat package)
java-1.7.0-oracle-javafx (Red Hat package)
java-1.7.0-oracle-src (Red Hat package)
java-1.7.0-oracle-plugin (Red Hat package)
java-1.7.0-oracle-jdbc (Red Hat package)
java-1.7.0-oracle-devel (Red Hat package)
java-1.7.0-oracle (Red Hat package)
java-1.8.0-oracle (Red Hat package)
java-1.8.0-oracle-devel (Red Hat package)
java-1.8.0-oracle-javafx (Red Hat package)
java-1.8.0-oracle-jdbc (Red Hat package)
java-1.8.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-src (Red Hat package)
syslinux-devel
syslinux-debugsource
syslinux-extlinux
syslinux-debuginfo
syslinux-extlinux-nonlinux
syslinux-nonlinux
syslinux-tftpboot
syslinux
syslinux-perl
syslinux-efi64
Planning Analytics Local
Red Hat Satellite
IBM MQ
IBM Cognos Controller
watsonx.data

Install update from vendor's website.

Zlib - update to 1.2.9
zlib (Ubuntu package) - update to 1:1.2.8.dfsg-2ubuntu4.3
zlib (Alpine package) - update to 1.2.11-r0
rsync (Ubuntu package) - addressed in versions 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1.1
perl (Alpine package) - update to 5.24.3-r1
java-1.6.0-sun-demo (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-devel (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-jdbc (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-plugin (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-src (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.7.0-oracle-javafx (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-src (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-plugin (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-jdbc (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-devel (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.8.0-oracle (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-devel (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-javafx (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-jdbc (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-plugin (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-src (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
watsonx.data - update to 2.1
syslinux-devel - update to 6.04-12
syslinux-debugsource - update to 6.04-12
syslinux-extlinux - update to 6.04-12
syslinux-debuginfo - update to 6.04-12
syslinux-extlinux-nonlinux - update to 6.04-12
syslinux-nonlinux - update to 6.04-12
syslinux-tftpboot - update to 6.04-12
syslinux - update to 6.04-12
syslinux-perl - update to 6.04-12
syslinux-efi64 - update to 6.04-12

• https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958
• https://bugzilla.redhat.com/show_bug.cgi?id=1402348

• SUSE Linux update for java-1_7_1-ibm
• SUSE Linux update for java-1_7_0-ibm
• SUSE Linux update for java-1_8_0-ibm
• SUSE Linux update for java-1_6_0-ibm
• Multiple vulnerabilities in IBM AIX
• Gentoo update for zlib
• Multiple vulnerabilities in IBM WebSphere MQ
• openSUSE update for java-1_8_0-openjdk
• SUSE Linux update for java-1_8_0-openjdk
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in IBM Cognos Controller
• Red Hat update for java-1.8.0-ibm
• Red Hat update for java-1.6.0-ibm
• Red Hat update for java-1.7.1-ibm
• Ubuntu update for zlib
• Ubuntu update for rsync
• Gentoo update for rsync
• Denial of service in perl (Alpine package)
• Denial of service in zlib (Alpine package)
• openEuler update for syslinux
• IBM watsonx.data update for zlib
• Denial of service in Zlib
• Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7 update for java-1.8.0-oracle
• Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7 update for java-1.6.0-sun
• Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7 update for java-1.7.0-oracle