VulnerabilityModified
CVE-2016-8704
An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
CRITICAL 9.8EPSS 23.2%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 23.2%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 23.17% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Affected
- memcached/memcached
- Source
- talos-cna@cisco.com
References
- http://rhn.redhat.com/errata/RHSA-2016-2819.html
- http://rhn.redhat.com/errata/RHSA-2016-2820.html
- http://www.debian.org/security/2016/dsa-3704
- http://www.securityfocus.com/bid/94083
- http://www.securitytracker.com/id/1037333
- http://www.talosintelligence.com/reports/TALOS-2016-0219/Exploit, Technical Description, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:0059
- https://security.gentoo.org/glsa/201701-12
- http://rhn.redhat.com/errata/RHSA-2016-2819.html
- http://rhn.redhat.com/errata/RHSA-2016-2820.html
- http://www.debian.org/security/2016/dsa-3704
- http://www.securityfocus.com/bid/94083
- http://www.securitytracker.com/id/1037333
- http://www.talosintelligence.com/reports/TALOS-2016-0219/Exploit, Technical Description, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:0059
- https://security.gentoo.org/glsa/201701-12
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.