CVE-2016-8704
Published: 2 November 2016
An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
Priority
CVSS 3 base score: 9.8
Status
| Package | Release | Status |
|---|---|---|
|
memcached Launchpad, Ubuntu, Debian |
upstream |
Released
(1.4.33)
|
| precise |
Released
(1.4.13-0ubuntu2.2)
|
|
| trusty |
Does not exist
(trusty was released [1.4.14-0ubuntu9.1])
|
|
| xenial |
Released
(1.4.25-2ubuntu1.2)
|
|
| yakkety |
Released
(1.4.25-2ubuntu2.1)
|
|
|
Patches: upstream: https://github.com/memcached/memcached/commit/bd578fc34b96abe0f8d99c1409814a09f51ee71c |
||
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8704
- http://www.talosintelligence.com/reports/TALOS-2016-0219/
- http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html
- https://github.com/memcached/memcached/wiki/ReleaseNotes1433
- https://ubuntu.com/security/notices/USN-3120-1
- NVD
- Launchpad
- Debian