kritisch
CVE-2016-8859
Multiple integer overflows in the TRE library and musl libc allow atta ...
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Ubuntu (mittel).
Beschreibung
Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggers an out-of-bounds write.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.10 | musl | 1.1.15-r4 |
| alpine 3.11 | musl | 1.1.15-r4 |
| alpine 3.12 | musl | 1.1.15-r4 |
| alpine 3.13 | musl | 1.1.15-r4 |
| alpine 3.14 | musl | 1.1.15-r4 |
| alpine 3.15 | musl | 1.1.15-r4 |
| alpine 3.16 | musl | 1.1.15-r4 |
| alpine 3.17 | musl | 1.1.15-r4 |
| alpine 3.18 | musl | 1.1.15-r4 |
| alpine 3.19 | musl | 1.1.15-r4 |
| alpine 3.2 | musl | 1.1.11-r3 |
| alpine 3.20 | musl | 1.1.15-r4 |
Alle 43 Einträge aus 35 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.10 | musl | 1.1.15-r4 |
| alpine 3.11 | musl | 1.1.15-r4 |
| alpine 3.12 | musl | 1.1.15-r4 |
| alpine 3.13 | musl | 1.1.15-r4 |
| alpine 3.14 | musl | 1.1.15-r4 |
| alpine 3.15 | musl | 1.1.15-r4 |
| alpine 3.16 | musl | 1.1.15-r4 |
| alpine 3.17 | musl | 1.1.15-r4 |
| alpine 3.18 | musl | 1.1.15-r4 |
| alpine 3.19 | musl | 1.1.15-r4 |
| alpine 3.2 | musl | 1.1.11-r3 |
| alpine 3.20 | musl | 1.1.15-r4 |
| alpine 3.21 | musl | 1.1.15-r4 |
| alpine 3.22 | musl | 1.1.15-r4 |
| alpine 3.23 | musl | 1.1.15-r4 |
| alpine 3.24 | musl | 1.1.15-r4 |
| alpine 3.3 | musl | 1.1.12-r6 |
| alpine 3.4 | musl | 1.1.14-r13 |
| alpine 3.5 | musl | 1.1.15-r4 |
| alpine 3.6 | musl | 1.1.15-r4 |
| alpine 3.7 | musl | 1.1.15-r4 |
| alpine 3.8 | musl | 1.1.15-r4 |
| alpine 3.9 | musl | 1.1.15-r4 |
| alpine edge | musl | 1.1.15-r4 |
| debian 11 | musl | 1.1.15-2 |
| debian 11 | tre | 0.8.0-5 |
| debian 12 | musl | 1.1.15-2 |
| debian 12 | tre | 0.8.0-5 |
| debian 13 | musl | 1.1.15-2 |
| debian 13 | tre | 0.8.0-5 |
| debian 14 | musl | 1.1.15-2 |
| debian 14 | tre | 0.8.0-5 |
| debian 7 | tre | 0.8.0-3+deb7u1 |
| debian 8 | musl | 1.1.5-2+deb8u1 |
| debian 8 | tre | 0.8.0-4+deb8u1 |
| echo | musl | 1.1.15-2 |
| echo | tre | 0.8.0-5 |
| ubuntu 14.04 | tre | 0.8.0-3+deb7u1ubuntu1 |
| ubuntu 14.04-ESM | musl | 0.9.15-1ubuntu0.1~esm1 |
| ubuntu 14.04-ESM | tre | 0.8.0-3+deb7u1ubuntu1 |
| ubuntu 16.04 | tre | 0.8.0-4+deb8u1build0.16.04.1 |
| ubuntu 16.04-ESM | musl | 1.1.9-1ubuntu0.1~esm2 |
| ubuntu 16.04-ESM | tre | 0.8.0-4+deb8u1build0.16.04.1 |
Referenzen
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- http://www.openwall.com/lists/oss-security/2016/10/19/1
- http://www.openwall.com/lists/oss-security/2016/10/19/10
- http://www.securityfocus.com/bid/93795
- https://security.gentoo.org/glsa/201701-11
- https://security.gentoo.org/glsa/202007-43
- https://ubuntu.com/security/notices/USN-4768-1
- https://www.cve.org/CVERecord?id=CVE-2016-8859