What’s Vulnerable › Vulnerabilities

CVE-2016-9843

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-05-23 · updated 2026-06-17

Description

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.

Affected products

• Apple Iphone Os: before 11 — fixed in 11
• macOS: from 10.0.0 before 10.13.0 — fixed in 10.13.0
• Apple tvOS: before 11.0 — fixed in 11.0
• Apple watchOS: before 4 — fixed in 4
• Canonical Ubuntu Linux: 16.04, 18.04
• Debian Linux: 8.0
• MariaDB: from 5.5.0 before 5.5.62; from 10.0.0 before 10.0.37; from 10.1.0 before 10.1.37; from 10.2.0 before 10.2.19; from 10.3.0 before 10.3.11 — fixed in 10.0.37, 10.1.37, 10.2.19, 10.3.11, 5.5.62
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
• OnCommand Insight: all versions
• NetApp OnCommand Workflow Automation: all versions
• NetApp SnapCenter: all versions
• Node.js: from 4.0.0 through 4.1.2; from 4.2.0 before 4.8.2; from 6.0.0 through 6.8.1; from 6.9.0 before 6.10.2; from 7.0.0 before 7.6.0 — fixed in 4.8.2, 6.10.2, 7.6.0
• openSUSE Leap: 42.1, 42.2
• Opensuse: 13.2
• Oracle Database: 18c
• Oracle Java SE: 1.6.0-update161, 1.7.0-update151, 1.8.0-update144
• Oracle Java SE: 1.6.0-update161, 1.7.0-update151, 1.8.0-update144
• MySQL Server: from 5.5.0 through 5.5.61; from 5.6.0 through 5.6.41; from 5.7.0 through 5.7.23; from 8.0.0 through 8.0.12
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Eus: 7.4, 7.5
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Workstation: 6.0, 7.0
• Red Hat Satellite 6: 5.8
• zlib: from 1.2.0 before 1.2.9 — fixed in 1.2.9

How to fix

Upgrade to a fixed version: Apple Iphone Os 11; macOS 10.13.0; Apple tvOS 11.0; Apple watchOS 4; MariaDB 10.0.37, 10.1.37, 10.2.19, 10.3.11; Node.js 4.8.2, 6.10.2, 7.6.0; zlib 1.2.9. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html
• http://www.openwall.com/lists/oss-security/2016/12/05/21
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/95131
• http://www.securitytracker.com/id/1039427
• http://www.securitytracker.com/id/1041888
• https://access.redhat.com/errata/RHSA-2017:1220
• https://access.redhat.com/errata/RHSA-2017:1221

Get alerted when CVE-2016-9843 or the next vulnerability affects your stack