CVE-2016-9840

2017-05-2300:00:00

ubuntu.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.013 Low

EPSS

Percentile

86.2%

JSON

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have
unspecified impact by leveraging improper pointer arithmetic.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=847270>

Notes

Author	Note
mdeslaur	since 3.1.3-7, rsync builds with the system zlib

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchklibc< 2.0.4-9ubuntu2.2+esm1UNKNOWN
ubuntu20.04noarchklibc< 2.0.7-1ubuntu5.2UNKNOWN
ubuntu22.04noarchklibc< 2.0.10-4ubuntu0.1UNKNOWN
ubuntu23.10noarchklibc< 2.0.13-1ubuntu0.1UNKNOWN
ubuntu24.04noarchklibc< 2.0.13-4ubuntu0.1UNKNOWN
ubuntu14.04noarchklibc< 2.0.3-0ubuntu1.14.04.3+esm3UNKNOWN
ubuntu16.04noarchklibc< 2.0.4-8ubuntu1.16.04.4+esm2UNKNOWN
ubuntu18.04noarchrsync< 3.1.2-2.1ubuntu1.1UNKNOWN
ubuntu19.04noarchrsync< 3.1.3-6UNKNOWN
ubuntu19.10noarchrsync< 3.1.3-6UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	klibc	< 2.0.4-9ubuntu2.2+esm1	UNKNOWN
ubuntu	20.04	noarch	klibc	< 2.0.7-1ubuntu5.2	UNKNOWN
ubuntu	22.04	noarch	klibc	< 2.0.10-4ubuntu0.1	UNKNOWN
ubuntu	23.10	noarch	klibc	< 2.0.13-1ubuntu0.1	UNKNOWN
ubuntu	24.04	noarch	klibc	< 2.0.13-4ubuntu0.1	UNKNOWN
ubuntu	14.04	noarch	klibc	< 2.0.3-0ubuntu1.14.04.3+esm3	UNKNOWN
ubuntu	16.04	noarch	klibc	< 2.0.4-8ubuntu1.16.04.4+esm2	UNKNOWN
ubuntu	18.04	noarch	rsync	< 3.1.2-2.1ubuntu1.1	UNKNOWN
ubuntu	19.04	noarch	rsync	< 3.1.3-6	UNKNOWN
ubuntu	19.10	noarch	rsync	< 3.1.3-6	UNKNOWN