Denial of service in Zlib - CVE-2016-9843

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU6666

Denial of service in Zlib - CVE-2016-9843

Published: May 24, 2017 / Updated: February 27, 2025


Vulnerability identifier: #VU6666
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-9843
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in zlib due to big-endian out-of-bounds pointer. A remote attacker can send a specially crafted document, trick the victim into opening it, and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.


Affected software

Zlib
Gentoo Linux
IBM AIX
SUSE OpenStack Cloud
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
SUSE Linux
Ubuntu
Opensuse
openEuler
Fedora
zlib (Ubuntu package)
zlib (Alpine package)
rsync (Ubuntu package)
perl (Alpine package)
java-1.6.0-sun-devel (Red Hat package)
java-1.6.0-sun-demo (Red Hat package)
java-1.6.0-sun (Red Hat package)
java-1.6.0-sun-jdbc (Red Hat package)
java-1.6.0-sun-plugin (Red Hat package)
java-1.6.0-sun-src (Red Hat package)
java-1.7.0-oracle (Red Hat package)
java-1.7.0-oracle-jdbc (Red Hat package)
java-1.7.0-oracle-devel (Red Hat package)
java-1.7.0-oracle-javafx (Red Hat package)
java-1.7.0-oracle-src (Red Hat package)
java-1.7.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-devel (Red Hat package)
java-1.8.0-oracle-javafx (Red Hat package)
java-1.8.0-oracle (Red Hat package)
java-1.8.0-oracle-jdbc (Red Hat package)
java-1.8.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-src (Red Hat package)
klibc (Ubuntu package)
syslinux
syslinux-tftpboot
syslinux-nonlinux
syslinux-extlinux-nonlinux
syslinux-debuginfo
syslinux-extlinux
syslinux-debugsource
syslinux-devel
syslinux-perl
syslinux-efi64
mariadb
Planning Analytics Local
Red Hat Satellite
IBM MQ
NetWorker
IBM Cognos Controller
Oracle Database Server

How to mitigate CVE-2016-9843

Install update from vendor's website.

Zlib - update to 1.2.9
zlib (Ubuntu package) - update to 1:1.2.8.dfsg-2ubuntu4.3
zlib (Alpine package) - update to 1.2.11-r0
rsync (Ubuntu package) - addressed in versions 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1.1
perl (Alpine package) - update to 5.24.3-r1
java-1.6.0-sun-devel (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-demo (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-jdbc (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-plugin (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.6.0-sun-src (Red Hat package) - addressed in versions 1.6.0.171-1jpp.4.el6, 1.6.0.171-1jpp.4.el7
java-1.7.0-oracle (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-jdbc (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-devel (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-javafx (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-src (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.7.0-oracle-plugin (Red Hat package) - addressed in versions 1.7.0.161-1jpp.3.el6, 1.7.0.161-1jpp.4.el7
java-1.8.0-oracle-devel (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-javafx (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-jdbc (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-plugin (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
java-1.8.0-oracle-src (Red Hat package) - addressed in versions 1.8.0.151-1jpp.1.el6, 1.8.0.151-1jpp.5.el7
klibc (Ubuntu package) - addressed in versions 2.0.3-0ubuntu1.14.04.3+esm4, 2.0.4-8ubuntu1.16.04.4+esm3, 2.0.4-9ubuntu2.2+esm2, 2.0.7-1ubuntu5.2+esm1, 2.0.10-4ubuntu0.2, 2.0.13-4ubuntu0.2, 2.0.13-4ubuntu1.1, 2.0.14-1ubuntu1.1
syslinux - update to 6.04-12
syslinux-tftpboot - update to 6.04-12
syslinux-nonlinux - update to 6.04-12
syslinux-extlinux-nonlinux - update to 6.04-12
syslinux-debuginfo - update to 6.04-12
syslinux-extlinux - update to 6.04-12
syslinux-debugsource - update to 6.04-12
syslinux-devel - update to 6.04-12
syslinux-perl - update to 6.04-12
syslinux-efi64 - update to 6.04-12
mariadb - addressed in versions 10.2.19-1.fc27, 10.2.19-1.fc28, 10.3.11-1.fc29
NetWorker - update to 19.9.0.1

External References

Related Security Bulletins