CVE-2016-8619 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
redhat	CNA	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 85%

Vendor	Product	Version
haxx	curl	𝑥 < 7.51.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

curl

bullseye	7.74.0-1.3+deb11u13 fixed
bullseye (security)	7.74.0-1.3+deb11u11 fixed
bookworm	7.88.1-10+deb12u7 fixed
bookworm (security)	7.88.1-10+deb12u5 fixed
sid	8.10.1-2 fixed
trixie	8.10.1-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

curl

zesty	Fixed 7.50.1-1ubuntu2 released
yakkety	Fixed 7.50.1-1ubuntu1.1 released
xenial	Fixed 7.47.0-1ubuntu2.2 released
trusty	Fixed 7.35.0-1ubuntu2.10 released
precise	Fixed 7.22.0-3ubuntu4.17 released

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CWE-415 - Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

http://www.securityfocus.com/bid/94100

http://www.securitytracker.com/id/1037192

https://access.redhat.com/errata/RHSA-2018:2486

https://access.redhat.com/errata/RHSA-2018:3558

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619

https://curl.haxx.se/CVE-2016-8619.patch

https://curl.haxx.se/docs/adv_20161102E.html

https://security.gentoo.org/glsa/201701-47

https://www.tenable.com/security/tns-2016-21

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

http://www.securityfocus.com/bid/94100

http://www.securitytracker.com/id/1037192

https://access.redhat.com/errata/RHSA-2018:2486

https://access.redhat.com/errata/RHSA-2018:3558

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619

https://curl.haxx.se/CVE-2016-8619.patch

https://curl.haxx.se/docs/adv_20161102E.html

https://security.gentoo.org/glsa/201701-47

https://www.tenable.com/security/tns-2016-21