{"id":"CVE-2016-9841","title":"inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.","summary":"inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"zlib","product":"zlib","affected":["zlib >= 1.2.0, < 1.2.9","leap = 42.1","leap = 42.2","opensuse = 13.2","debian_linux = 8.0","ubuntu_linux = 16.04","ubuntu_linux = 18.04","database_server = 18c","jdk = 1.6.0","jdk = 1.7.0","jdk = 1.8.0","jre = 1.6.0","jre = 1.7.0","jre = 1.8.0","mysql >= 5.5.0, <= 5.5.61","mysql >= 5.6.0, <= 5.6.41","mysql >= 5.7.0, <= 5.7.23","mysql >= 8.0.0, <= 8.0.12","satellite = 5.8","enterprise_linux_desktop = 6.0","enterprise_linux_desktop = 7.0","enterprise_linux_eus = 7.4","enterprise_linux_eus = 7.5","enterprise_linux_server = 6.0","enterprise_linux_server = 7.0","enterprise_linux_workstation = 6.0","enterprise_linux_workstation = 7.0","iphone_os < 11","mac_os_x >= 10.0.0, < 10.13.0","tvos < 11.0","watchos < 4","active_iq_unified_manager >= 7.3","active_iq_unified_manager >= 9.5","cloud_backup","e-series_santricity_management","e-series_santricity_os_controller >= 11.0.0, <= 11.70.1","e-series_santricity_storage_manager","e-series_santricity_web_services","oncommand_balance","oncommand_insight","oncommand_performance_manager","oncommand_shift","oncommand_unified_manager <= 7.1","oncommand_unified_manager","oncommand_workflow_automation","snapmanager","solidfire","steelstore_cloud_integrated_storage","storage_replication_adapter_for_clustered_data_ontap","symantec_netbackup","vasa_provider_for_clustered_data_ontap >= 7.2","virtual_storage_console","hci_storage_node","node.js >= 4.0.0, <= 4.1.2","node.js >= 4.2.0, < 4.8.2","node.js >= 6.0.0, <= 6.8.1","node.js >= 6.9.0, < 6.10.2","node.js >= 7.0.0, < 7.6.0"],"patched":["zlib 1.2.9","iphone_os 11","mac_os_x 10.13.0","tvos 11.0","watchos 4","node.js 7.6.0"],"published":"2017-05-23","updated":"2026-07-14","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2016-9841","references":[{"url":"http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","label":"security@opentext.com"},{"url":"http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","label":"security@opentext.com"},{"url":"http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","label":"security@opentext.com"},{"url":"http://www.openwall.com/lists/oss-security/2016/12/05/21","label":"security@opentext.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","label":"security@opentext.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","label":"security@opentext.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","label":"security@opentext.com"},{"url":"http://www.securityfocus.com/bid/95131","label":"security@opentext.com"},{"url":"http://www.securitytracker.com/id/1039427","label":"security@opentext.com"},{"url":"http://www.securitytracker.com/id/1039596","label":"security@opentext.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:1220","label":"security@opentext.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:1221","label":"security@opentext.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:1222","label":"security@opentext.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:2999","label":"security@opentext.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3046","label":"security@opentext.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3047","label":"security@opentext.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3453","label":"security@opentext.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1402346","label":"security@opentext.com"},{"url":"https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb","label":"security@opentext.com"},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","label":"security@opentext.com"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","label":"security@opentext.com"},{"url":"https://security.gentoo.org/glsa/201701-56","label":"security@opentext.com"},{"url":"https://security.gentoo.org/glsa/202007-54","label":"security@opentext.com"},{"url":"https://security.netapp.com/advisory/ntap-20171019-0001/","label":"security@opentext.com"},{"url":"https://support.apple.com/HT208112","label":"security@opentext.com"},{"url":"https://support.apple.com/HT208113","label":"security@opentext.com"},{"url":"https://support.apple.com/HT208115","label":"security@opentext.com"},{"url":"https://support.apple.com/HT208144","label":"security@opentext.com"},{"url":"https://usn.ubuntu.com/4246-1/","label":"security@opentext.com"},{"url":"https://usn.ubuntu.com/4292-1/","label":"security@opentext.com"},{"url":"https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","label":"security@opentext.com"},{"url":"https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","label":"security@opentext.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"security@opentext.com"},{"url":"http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2016/12/05/21","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/95131","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1039427","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1039596","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:1220","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:1221","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:1222","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:2999","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3046","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3047","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3453","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1402346","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201701-56","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202007-54","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20171019-0001/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT208112","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT208113","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT208115","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT208144","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4246-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4292-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-470355.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.0755,"epssPercentile":0.9433,"ingestedAt":"2026-07-14T12:36:47.571Z","slug":"CVE-2016-9841","body":"## Overview\n\ninffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.\n\n## Affected\n\n- `zlib >= 1.2.0, < 1.2.9`\n- `leap = 42.1`\n- `leap = 42.2`\n- `opensuse = 13.2`\n- `debian_linux = 8.0`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `database_server = 18c`\n- `jdk = 1.6.0`\n- `jdk = 1.7.0`\n- `jdk = 1.8.0`\n- `jre = 1.6.0`\n- `jre = 1.7.0`\n- `jre = 1.8.0`\n- `mysql >= 5.5.0, <= 5.5.61`\n- `mysql >= 5.6.0, <= 5.6.41`\n- `mysql >= 5.7.0, <= 5.7.23`\n- `mysql >= 8.0.0, <= 8.0.12`\n- `satellite = 5.8`\n- `enterprise_linux_desktop = 6.0`\n- `enterprise_linux_desktop = 7.0`\n- `enterprise_linux_eus = 7.4`\n- `enterprise_linux_eus = 7.5`\n- `enterprise_linux_server = 6.0`\n- `enterprise_linux_server = 7.0`\n- `enterprise_linux_workstation = 6.0`\n- `enterprise_linux_workstation = 7.0`\n- `iphone_os < 11`\n- `mac_os_x >= 10.0.0, < 10.13.0`\n- `tvos < 11.0`\n- `watchos < 4`\n- `active_iq_unified_manager >= 7.3`\n- `active_iq_unified_manager >= 9.5`\n- `cloud_backup`\n- `e-series_santricity_management`\n- `e-series_santricity_os_controller >= 11.0.0, <= 11.70.1`\n- `e-series_santricity_storage_manager`\n- `e-series_santricity_web_services`\n- `oncommand_balance`\n- `oncommand_insight`\n- `oncommand_performance_manager`\n- `oncommand_shift`\n- `oncommand_unified_manager <= 7.1`\n- `oncommand_unified_manager`\n- `oncommand_workflow_automation`\n- `snapmanager`\n- `solidfire`\n- `steelstore_cloud_integrated_storage`\n- `storage_replication_adapter_for_clustered_data_ontap`\n- `symantec_netbackup`\n- `vasa_provider_for_clustered_data_ontap >= 7.2`\n- `virtual_storage_console`\n- `hci_storage_node`\n- `node.js >= 4.0.0, <= 4.1.2`\n- `node.js >= 4.2.0, < 4.8.2`\n- `node.js >= 6.0.0, <= 6.8.1`\n- `node.js >= 6.9.0, < 6.10.2`\n- `node.js >= 7.0.0, < 7.6.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `zlib 1.2.9`\n- `iphone_os 11`\n- `mac_os_x 10.13.0`\n- `tvos 11.0`\n- `watchos 4`\n- `node.js 7.6.0`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":53.9,"likelihood":1.5,"exploitation":0,"ransomware":0},"changes":[]}