critique
CVE-2016-8859
Multiple integer overflows in the TRE library and musl libc allow atta ...
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Ubuntu (moyenne).
Description
Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggers an out-of-bounds write.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.10 | musl | 1.1.15-r4 |
| alpine 3.11 | musl | 1.1.15-r4 |
| alpine 3.12 | musl | 1.1.15-r4 |
| alpine 3.13 | musl | 1.1.15-r4 |
| alpine 3.14 | musl | 1.1.15-r4 |
| alpine 3.15 | musl | 1.1.15-r4 |
| alpine 3.16 | musl | 1.1.15-r4 |
| alpine 3.17 | musl | 1.1.15-r4 |
| alpine 3.18 | musl | 1.1.15-r4 |
| alpine 3.19 | musl | 1.1.15-r4 |
| alpine 3.2 | musl | 1.1.11-r3 |
| alpine 3.20 | musl | 1.1.15-r4 |
Afficher les 43 entrées de 35 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.10 | musl | 1.1.15-r4 |
| alpine 3.11 | musl | 1.1.15-r4 |
| alpine 3.12 | musl | 1.1.15-r4 |
| alpine 3.13 | musl | 1.1.15-r4 |
| alpine 3.14 | musl | 1.1.15-r4 |
| alpine 3.15 | musl | 1.1.15-r4 |
| alpine 3.16 | musl | 1.1.15-r4 |
| alpine 3.17 | musl | 1.1.15-r4 |
| alpine 3.18 | musl | 1.1.15-r4 |
| alpine 3.19 | musl | 1.1.15-r4 |
| alpine 3.2 | musl | 1.1.11-r3 |
| alpine 3.20 | musl | 1.1.15-r4 |
| alpine 3.21 | musl | 1.1.15-r4 |
| alpine 3.22 | musl | 1.1.15-r4 |
| alpine 3.23 | musl | 1.1.15-r4 |
| alpine 3.24 | musl | 1.1.15-r4 |
| alpine 3.3 | musl | 1.1.12-r6 |
| alpine 3.4 | musl | 1.1.14-r13 |
| alpine 3.5 | musl | 1.1.15-r4 |
| alpine 3.6 | musl | 1.1.15-r4 |
| alpine 3.7 | musl | 1.1.15-r4 |
| alpine 3.8 | musl | 1.1.15-r4 |
| alpine 3.9 | musl | 1.1.15-r4 |
| alpine edge | musl | 1.1.15-r4 |
| debian 11 | musl | 1.1.15-2 |
| debian 11 | tre | 0.8.0-5 |
| debian 12 | musl | 1.1.15-2 |
| debian 12 | tre | 0.8.0-5 |
| debian 13 | musl | 1.1.15-2 |
| debian 13 | tre | 0.8.0-5 |
| debian 14 | musl | 1.1.15-2 |
| debian 14 | tre | 0.8.0-5 |
| debian 7 | tre | 0.8.0-3+deb7u1 |
| debian 8 | musl | 1.1.5-2+deb8u1 |
| debian 8 | tre | 0.8.0-4+deb8u1 |
| echo | musl | 1.1.15-2 |
| echo | tre | 0.8.0-5 |
| ubuntu 14.04 | tre | 0.8.0-3+deb7u1ubuntu1 |
| ubuntu 14.04-ESM | musl | 0.9.15-1ubuntu0.1~esm1 |
| ubuntu 14.04-ESM | tre | 0.8.0-3+deb7u1ubuntu1 |
| ubuntu 16.04 | tre | 0.8.0-4+deb8u1build0.16.04.1 |
| ubuntu 16.04-ESM | musl | 1.1.9-1ubuntu0.1~esm2 |
| ubuntu 16.04-ESM | tre | 0.8.0-4+deb8u1build0.16.04.1 |
Références
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- http://www.openwall.com/lists/oss-security/2016/10/19/1
- http://www.openwall.com/lists/oss-security/2016/10/19/10
- http://www.securityfocus.com/bid/93795
- https://security.gentoo.org/glsa/201701-11
- https://security.gentoo.org/glsa/202007-43
- https://ubuntu.com/security/notices/USN-4768-1
- https://www.cve.org/CVERecord?id=CVE-2016-8859