What’s Vulnerable › Vulnerabilities

CVE-2016-9841

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-05-23 · updated 2026-10-08

Description

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Affected products

• Apple Iphone Os: before 11 — fixed in 11
• macOS: from 10.0.0 before 10.13.0 — fixed in 10.13.0
• Apple tvOS: before 11.0 — fixed in 11.0
• Apple watchOS: before 4 — fixed in 4
• Canonical Ubuntu Linux: 16.04, 18.04
• Debian Linux: 8.0
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
• NetApp Cloud Backup: all versions
• NetApp E-Series Santricity Management: all versions
• E-Series SANtricity OS Controller Software 11.x: from 11.0.0 through 11.70.1
• NetApp E-Series Santricity Storage Manager: all versions
• NetApp E-Series Santricity Web Services: all versions
• NetApp Hci Storage Node: all versions
• NetApp Oncommand Balance: all versions
• OnCommand Insight: all versions
• NetApp Oncommand Performance Manager: all versions
• NetApp Oncommand Shift: all versions
• NetApp OnCommand Unified Manager for 7-Mode (core package): through 7.1
• NetApp OnCommand Workflow Automation: all versions
• SnapManager for Oracle: all versions
• NetApp Solidfire: all versions
• NetApp Steelstore Cloud Integrated Storage: all versions
• NetApp Storage Replication Adapter For Clustered Data Ontap: all versions
• NetApp Symantec Netbackup: all versions
• NetApp Vasa Provider For Clustered Data Ontap: from 7.2
• NetApp Virtual Storage Console: all versions
• Node.js: from 4.0.0 through 4.1.2; from 4.2.0 before 4.8.2; from 6.0.0 through 6.8.1; from 6.9.0 before 6.10.2; from 7.0.0 before 7.6.0 — fixed in 4.8.2, 6.10.2, 7.6.0
• openSUSE Leap: 42.1, 42.2
• Opensuse: 13.2
• Oracle Database: 18c

How to fix

Upgrade to a fixed version: Apple Iphone Os 11; macOS 10.13.0; Apple tvOS 11.0; Apple watchOS 4; Node.js 4.8.2, 6.10.2, 7.6.0; zlib 1.2.9. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html
• http://www.openwall.com/lists/oss-security/2016/12/05/21
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/95131
• http://www.securitytracker.com/id/1039427
• http://www.securitytracker.com/id/1039596
• https://access.redhat.com/errata/RHSA-2017:1220
• https://access.redhat.com/errata/RHSA-2017:1221

Get alerted when CVE-2016-9841 or the next vulnerability affects your stack