Vulnerability CVE-2016-9085

Vulnerability Name:

CVE-2016-9085 (CCN-122224)

Assigned:

2016-10-27

Published:

2016-10-27

Updated:

2021-02-25

Summary:

Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.

CVSS v3 Severity:

3.3 Low (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
2.9 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-190

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2016-9085

Source: CCN
Type: oss-sec Mailing List, Thu, 27 Oct 2016 03:06:55 -0400 (EDT)
Re: CVE requests: some issues in gif2webp

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[oss-security] 20161027 Re: CVE requests: some issues in gif2webp

Source: BID
Type: Third Party Advisory, VDB Entry
93928

Source: CCN
Type: BID-93928
Libwebp 'gif2webp.c' Multiple Integer Overflow Vulnerabilities

Source: CONFIRM
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1389338

Source: CCN
Type: chromium GIT repositories
chromium / webm / libwebp / 806f6279aef4de8deca01c8e727db4a508716e95

Source: CONFIRM
Type: Issue Tracking, Patch, Third Party Advisory
https://chromium.googlesource.com/webm/libwebp/+/e2affacc35f1df6cc3b1a9fa0ceff5ce2d0cce83

Source: XF
Type: UNKNOWN
libwebp-cve20169085-dos(122224)

Source: MLIST
Type: UNKNOWN
[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar

Source: FEDORA
Type: Third Party Advisory
FEDORA-2016-00d2f5c19f

Source: FEDORA
Type: Third Party Advisory
FEDORA-2016-160ec6525e

Source: FEDORA
Type: Third Party Advisory
FEDORA-2016-26ef59f03d

Source: GENTOO
Type: Third Party Advisory, VDB Entry
GLSA-201701-61

Vulnerable Configuration:

Configuration 1:

cpe:/a:webmproject:libwebp:*:*:*:*:*:*:*:* (Version <= 0.5.2)

Configuration 2:

cpe:/o:fedoraproject:fedora:25:*:*:*:*:*:*:*

OR cpe:/o:fedoraproject:fedora:24:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20169085	V	CVE-2016-9085	2023-06-22
oval:org.opensuse.security:def:7697	P	libwebp-devel-1.0.3-3.2.1 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:3105	P	ibus-1.5.13-15.11.2 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94735	P	libwebp-devel-1.0.3-3.2.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:225	P	libwebp-devel-1.0.3-1.62 on GA media (Moderate)	2022-06-13
oval:org.opensuse.security:def:1154	P	Security update for subversion (Important)	2022-04-12
oval:org.opensuse.security:def:70020	P	Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-operator-container (Important) (in QA)	2022-01-03
oval:org.opensuse.security:def:817	P	Security update for speex (Moderate)	2021-12-01
oval:org.opensuse.security:def:1262	P	Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP3) (Important)	2021-09-16
oval:org.opensuse.security:def:69909	P	Security update for fetchmail (Moderate)	2021-08-20
oval:org.opensuse.security:def:62243	P	libwebp-devel-1.0.3-1.62 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:71984	P	libwebp-devel-1.0.3-1.62 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:100802	P	cifs-utils-6.9-5.12.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1618	P	Security update for qemu (Moderate)	2021-06-30
oval:org.opensuse.security:def:66769	P	Security update for libxml2 (Moderate)	2021-05-05
oval:org.opensuse.security:def:69804	P	Security update for git (Important)	2021-03-09
oval:org.opensuse.security:def:100586	P	(Moderate)	2020-12-10
oval:org.opensuse.security:def:116810	P	libwebp7-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:93873	P	libwebp7-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:61906	P	libwebp7-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107252	P	libwebp7-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:117026	P	libwebp-devel-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:94089	P	libwebp-devel-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:71647	P	libwebp7-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107468	P	libwebp-devel-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62707	P	libwebp-devel-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72426	P	libwebp-devel-1.0.3-1.62 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:73244	P	libwebp7 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:66553	P	libwebp7 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:66677	P	accountsservice on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73342	P	xalan-j2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73460	P	libwebp-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49204	P	liboath-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49258	P	libwebp7 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49649	P	libSoundTouch0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49703	P	libwebp-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:66461	P	libevent-2_1-8 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73126	P	libXcursor-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:70125	P	libwebp-devel on GA media (Moderate)	2020-12-01
oval:com.ubuntu.bionic:def:201690850000000	V	CVE-2016-9085 on Ubuntu 18.04 LTS (bionic) - medium.	2017-02-03
oval:com.ubuntu.artful:def:20169085000	V	CVE-2016-9085 on Ubuntu 17.10 (artful) - medium.	2017-02-03
oval:com.ubuntu.trusty:def:20169085000	V	CVE-2016-9085 on Ubuntu 14.04 LTS (trusty) - medium.	2017-02-03
oval:com.ubuntu.xenial:def:201690850000000	V	CVE-2016-9085 on Ubuntu 16.04 LTS (xenial) - medium.	2017-02-03
oval:com.ubuntu.bionic:def:20169085000	V	CVE-2016-9085 on Ubuntu 18.04 LTS (bionic) - medium.	2017-02-03
oval:com.ubuntu.xenial:def:20169085000	V	CVE-2016-9085 on Ubuntu 16.04 LTS (xenial) - medium.	2017-02-03
oval:com.ubuntu.disco:def:201690850000000	V	CVE-2016-9085 on Ubuntu 19.04 (disco) - medium.	2017-02-03
oval:com.ubuntu.cosmic:def:20169085000	V	CVE-2016-9085 on Ubuntu 18.10 (cosmic) - medium.	2017-02-03
oval:com.ubuntu.cosmic:def:201690850000000	V	CVE-2016-9085 on Ubuntu 18.10 (cosmic) - medium.	2017-02-03
oval:com.ubuntu.precise:def:20169085000	V	CVE-2016-9085 on Ubuntu 12.04 LTS (precise) - medium.	2017-02-03

BACK