CVE-2016-8859

NameCVE-2016-8859
DescriptionMultiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggers an out-of-bounds write.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-687-1
NVD severityhigh (attack range: remote)
Debian Bugs842169, 842171

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
musl (PTS)jessie1.1.5-2+deb8u1fixed
stretch, sid1.1.16-3fixed
tre (PTS)wheezy0.8.0-3vulnerable
wheezy (security)0.8.0-3+deb7u1fixed
jessie0.8.0-4+deb8u1fixed
stretch, sid0.8.0-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
muslsource(unstable)1.1.15-2high842171
muslsourcejessie1.1.5-2+deb8u1high
tresource(unstable)0.8.0-5high842169
tresourcejessie0.8.0-4+deb8u1high
tresourcewheezy0.8.0-3+deb7u1highDLA-687-1

Notes

http://www.openwall.com/lists/oss-security/2016/10/19/1
other issues may still be present in tre after this: https://github.com/laurikari/tre/issues/37
musl patch: http://git.musl-libc.org/cgit/musl/commit/?id=c3edc06d1e1360f3570db9155d6b318ae0d0f0f7, not released yet

Search for package or bug name: Reporting problems