CVE-2016-9841
criticalinffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Vendor / product: Zlib — zlib
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2017-05-23 04:29
Modified: 2026-10-08 22:16
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
zlib / zlib ≥1.2.0 <1.2.9
opensuse / leap 42.1, 42.2
opensuse / opensuse 13.2
debian / debian_linux 8.0
canonical / ubuntu_linux 16.04, 18.04
oracle / database_server 18c
oracle / jdk 1.6.0, 1.7.0, 1.8.0
oracle / jre 1.6.0, 1.7.0, 1.8.0
oracle / mysql ≥5.5.0 ≤5.5.61, ≥5.6.0 ≤5.6.41, ≥5.7.0 ≤5.7.23, ≥8.0.0 ≤8.0.12
redhat / satellite 5.8
redhat / enterprise_linux_desktop 6.0, 7.0
redhat / enterprise_linux_eus 7.4, 7.5
redhat / enterprise_linux_server 6.0, 7.0
redhat / enterprise_linux_workstation 6.0, 7.0
apple / iphone_os <11
apple / mac_os_x ≥10.0.0 <10.13.0
apple / tvos <11.0
apple / watchos <4
netapp / active_iq_unified_manager ≥7.3, ≥9.5
netapp / cloud_backup all versions
netapp / e-series_santricity_management all versions
netapp / e-series_santricity_os_controller ≥11.0.0 ≤11.70.1
netapp / e-series_santricity_storage_manager all versions
netapp / e-series_santricity_web_services all versions
netapp / oncommand_balance all versions
netapp / oncommand_insight all versions
netapp / oncommand_performance_manager all versions
netapp / oncommand_shift all versions
netapp / oncommand_unified_manager ≤7.1, all versions
netapp / oncommand_workflow_automation all versions
netapp / snapmanager all versions
netapp / solidfire all versions
netapp / steelstore_cloud_integrated_storage all versions
netapp / storage_replication_adapter_for_clustered_data_ontap all versions
netapp / symantec_netbackup all versions
netapp / vasa_provider_for_clustered_data_ontap ≥7.2
netapp / virtual_storage_console all versions
netapp / hci_storage_node all versions
nodejs / node.js ≥4.0.0 ≤4.1.2, ≥4.2.0 <4.8.2, ≥6.0.0 ≤6.8.1, ≥6.9.0 <6.10.2, ≥7.0.0 <7.6.0
Weakness classification (CWE)
NVD-CWE-noinfo
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html security@opentext.com
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html security@opentext.com
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html security@opentext.com
- http://www.openwall.com/lists/oss-security/2016/12/05/21 security@opentext.com
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html security@opentext.com
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html security@opentext.com
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html security@opentext.com
- http://www.securityfocus.com/bid/95131 security@opentext.com
- http://www.securitytracker.com/id/1039427 security@opentext.com
- http://www.securitytracker.com/id/1039596 security@opentext.com
- https://access.redhat.com/errata/RHSA-2017:1220 security@opentext.com
- https://access.redhat.com/errata/RHSA-2017:1221 security@opentext.com
- https://access.redhat.com/errata/RHSA-2017:1222 security@opentext.com
- https://access.redhat.com/errata/RHSA-2017:2999 security@opentext.com
- https://access.redhat.com/errata/RHSA-2017:3046 security@opentext.com
- https://access.redhat.com/errata/RHSA-2017:3047 security@opentext.com
- https://access.redhat.com/errata/RHSA-2017:3453 security@opentext.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1402346 security@opentext.com
- https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb security@opentext.com
- https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html security@opentext.com
- https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html security@opentext.com
- https://security.gentoo.org/glsa/201701-56 security@opentext.com
- https://security.gentoo.org/glsa/202007-54 security@opentext.com
- https://security.netapp.com/advisory/ntap-20171019-0001/ security@opentext.com
- https://support.apple.com/HT208112 security@opentext.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗