CVE-2016-8705

Name	CVE-2016-8705
Description	Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-701-1, DSA-3704-1
Debian Bugs	842812

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
memcached (PTS)	buster	1.5.6-1.1	fixed
	bullseye	1.6.9+dfsg-1	fixed
	bookworm	1.6.18-1	fixed
	sid	1.6.19-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
memcached	source	wheezy	1.4.13-0.2+deb7u2	DLA-701-1
memcached	source	jessie	1.4.21-1.1+deb8u1	DSA-3704-1
memcached	source	(unstable)	1.4.33-1		842812

Notes

http://www.talosintelligence.com/reports/TALOS-2016-0220/
upstream fix https://github.com/memcached/memcached/commit/bd578fc34b96abe0f8d99c1409814a09f51ee71c