CVE-2016-8705
Published: 02 November 2016
Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
Priority
CVSS 3 base score: 9.8
Status
Package | Release | Status |
---|---|---|
memcached Launchpad, Ubuntu, Debian |
Upstream |
Released
(1.4.33)
|
Ubuntu 16.04 LTS (Xenial Xerus) |
Released
(1.4.25-2ubuntu1.2)
|
|
Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
(trusty was released [1.4.14-0ubuntu9.1])
|
|
Patches: Upstream: https://github.com/memcached/memcached/commit/bd578fc34b96abe0f8d99c1409814a09f51ee71c |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8705
- http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html
- http://www.talosintelligence.com/reports/TALOS-2016-0220/
- https://github.com/memcached/memcached/wiki/ReleaseNotes1433
- https://usn.ubuntu.com/usn/usn-3120-1
- NVD
- Launchpad
- Debian