VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 18 hours ago

CVE-2016-9841

9.8 Critical Mitigated by environment configuration

Description

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 9 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 7.5% chance in 30 days

Waratek Defense Posture

Mitigated by environment configuration

The vulnerability is mitigated through deployment or application configuration rather than by an ARMR rule. This is a historical determination; the specific configuration change may not be recorded.

  • Protection full the deployment environment, not the agent
  • Action not-needed
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification assigned status: MITIGATED-BY-ENVIRONMENT

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 no band published AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update October 2017 ↗ CPU 2017-Q4 Oracle Java SE / Util (zlib) (Java SE: 6u161, 7u151, 8u144; Java SE Embedded: 8u144)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Java SE Util (zlib) Java SE: 6u161, 7u151, 8u144; Java SE Embedded: 8u144 6.0.161.0 · 7.0.151.0 · 8.0.144.0

🖥️ Product CPEs & Version Ranges

39 product(s) over 58 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd apple iphone os generic ＜ 11
nvd apple mac os x generic ≥ 10.0.0 and ＜ 10.13.0
nvd apple tvos generic ＜ 11.0
nvd apple watchos generic ＜ 4
nvd canonical ubuntu linux generic 16.04 · 18.04
nvd debian debian linux generic 8.0
nvd netapp active iq unified manager generic ≥ 7.3 · ≥ 9.5
nvd netapp cloud backup generic any version
nvd netapp e-series santricity management generic any version
nvd netapp e-series santricity os controller generic ≥ 11.0.0 and ≤ 11.70.1
nvd netapp e-series santricity storage manager generic any version
nvd netapp e-series santricity web services generic any version
nvd netapp hci storage node generic any version
nvd netapp oncommand balance generic any version
nvd netapp oncommand insight generic any version
nvd netapp oncommand performance manager generic any version
nvd netapp oncommand shift generic any version
nvd netapp oncommand unified manager generic any version · ≤ 7.1
nvd netapp oncommand workflow automation generic any version
nvd netapp snapmanager generic any version
nvd netapp solidfire generic any version
nvd netapp steelstore cloud integrated storage generic any version
nvd netapp storage replication adapter for clustered data ontap generic any version
nvd netapp symantec netbackup generic any version
nvd netapp vasa provider for clustered data ontap generic ≥ 7.2
nvd netapp virtual storage console generic any version
nvd nodejs node.js generic ≥ 4.0.0 and ≤ 4.1.2 · ≥ 4.2.0 and ＜ 4.8.2 · ≥ 6.0.0 and ≤ 6.8.1 · ≥ 6.9.0 and ＜ 6.10.2 · ≥ 7.0.0 and ＜ 7.6.0
nvd opensuse leap generic 42.1 · 42.2
nvd opensuse opensuse generic 13.2
nvd oracle database server generic 18c
nvd oracle jdk javase 1.6.0:update161 · 1.7.0:update151 · 1.8.0:update144
nvd oracle jre javase 1.6.0:update161 · 1.7.0:update151 · 1.8.0:update144
nvd oracle mysql generic ≥ 5.5.0 and ≤ 5.5.61 · ≥ 5.6.0 and ≤ 5.6.41 · ≥ 5.7.0 and ≤ 5.7.23 · ≥ 8.0.0 and ≤ 8.0.12
nvd redhat enterprise linux desktop generic 6.0 · 7.0
nvd redhat enterprise linux eus generic 7.4 · 7.5
nvd redhat enterprise linux server generic 6.0 · 7.0
nvd redhat enterprise linux workstation generic 6.0 · 7.0
nvd redhat satellite generic 5.8
nvd zlib zlib generic ≥ 1.2.0 and ＜ 1.2.9

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** UTIL (ZLIB), MULTIPLE, SEE NOTE 1, NO AUTH REMOTE EXPLOIT **Products:** JAVA SE EMBEDDED, ZLIB, JAVA SE, ORACLE JAVA SE

References

URLTags
https://access.redhat.com/errata/RHSA-2017:1220 ADVISORY, RHSA-2017:1220
https://access.redhat.com/security/cve/CVE-2016-9841 REPORT, RHSA-2017:1220
https://access.redhat.com/errata/RHSA-2017:2999 ADVISORY, RHSA-2017:2999
https://access.redhat.com/errata/RHSA-2017:3453 ADVISORY, RHSA-2017:3453
http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html
http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html
http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html
http://www.openwall.com/lists/oss-security/2016/12/05/21
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Timeline

Published 2017-05-23 Last modified 2026-07-14
Published2017-05-23By the CVE Program.
NVD record modified2026-07-14NVD's own last-modified date for this record.