What’s Vulnerable › Vulnerabilities

CVE-2016-6264

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-01-27 · updated 2026-06-17

Description

Integer signedness error in libc/string/arm/memset.S in uClibc and uClibc-ng before 1.0.16 allows context-dependent attackers to cause a denial of service (crash) via a negative length value to the memset function.

Affected products

• uClibC: all versions
• uClibC-ng: before 1.0.16 — fixed in 1.0.16

How to fix

Upgrade to a fixed version: uClibC-ng 1.0.16. Check the vendor advisory for mitigations.

References

• http://mailman.uclibc-ng.org/pipermail/devel/2016-July/001067.html
• http://mailman.uclibc-ng.org/pipermail/devel/2016-May/000890.html
• http://www.openwall.com/lists/oss-security/2016/06/29/3
• http://www.openwall.com/lists/oss-security/2016/07/21/2
• http://www.openwall.com/lists/oss-security/2016/07/21/6
• http://www.securityfocus.com/bid/91492
• http://mailman.uclibc-ng.org/pipermail/devel/2016-July/001067.html
• http://mailman.uclibc-ng.org/pipermail/devel/2016-May/000890.html
• http://www.openwall.com/lists/oss-security/2016/06/29/3
• http://www.openwall.com/lists/oss-security/2016/07/21/2
• http://www.openwall.com/lists/oss-security/2016/07/21/6
• http://www.securityfocus.com/bid/91492

Get alerted when CVE-2016-6264 or the next vulnerability affects your stack