CVE-2016-8704

Name	CVE-2016-8704
Description	An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-701-1, DSA-3704-1
Debian Bugs	842811

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
memcached (PTS)	bullseye	1.6.9+dfsg-1	fixed
	bookworm	1.6.18-1	fixed
	trixie	1.6.32-1	fixed
	sid	1.6.32-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
memcached	source	wheezy	1.4.13-0.2+deb7u2	DLA-701-1
memcached	source	jessie	1.4.21-1.1+deb8u1	DSA-3704-1
memcached	source	(unstable)	1.4.33-1		842811

Notes

http://www.talosintelligence.com/reports/TALOS-2016-0219/
upstream fix https://github.com/memcached/memcached/commit/bd578fc34b96abe0f8d99c1409814a09f51ee71c