CVE-2016-9842

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-23 · updated 2026-07-14
Weakness: CWE-1335

Description

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

Affected products

Apple Iphone Os: before 11 — fixed in 11
macOS: from 10.0.0 before 10.13.0 — fixed in 10.13.0
Apple tvOS: before 11.0 — fixed in 11.0
Apple watchOS: before 4 — fixed in 4
Canonical Ubuntu Linux: 16.04, 18.04
Debian Linux: 8.0
Node.js: from 4.0.0 through 4.1.2; from 4.2.0 before 4.8.2; from 6.0.0 through 6.8.1; from 6.9.0 before 6.10.2; from 7.0.0 before 7.6.0 — fixed in 4.8.2, 6.10.2, 7.6.0
openSUSE Leap: 42.1, 42.2
Opensuse: 13.2
Oracle Database: 18c
Oracle Java SE: 1.6.0-update161, 1.7.0-update151, 1.8.0-update144
Oracle Java SE: 1.6.0-update161, 1.7.0-update151, 1.8.0-update144
MySQL Server: from 5.5.0 through 5.5.61; from 5.6.0 through 5.6.41; from 5.7.0 through 5.7.23; from 8.0.0 through 8.0.12
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Eus: 7.4, 7.5
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Workstation: 6.0, 7.0
Red Hat Satellite 6: 5.8
zlib: from 1.2.3.4 before 1.2.9 — fixed in 1.2.9

How to fix

Upgrade to a fixed version: Apple Iphone Os 11; macOS 10.13.0; Apple tvOS 11.0; Apple watchOS 4; Node.js 4.8.2, 6.10.2, 7.6.0; zlib 1.2.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-9842 or the next vulnerability affects your stack