CVE-2016-9036
libmsgpuck-dev: An exploitable incorrect return value vulnerability exists in the mp_check function of Tarantool's Msgpuck library 1.0.3
CVE-2016-9036 is fixed in libmsgpuck-dev on 1 platform, first by libmsgpuck-dev 1.0.3-1.1, released December 23, 2016. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0283
86th percentile
An exploitable incorrect return value vulnerability exists in the mp_check function of Tarantool's Msgpuck library 1.0.3. A specially crafted packet can cause the mp_check function to incorrectly return success when trying to check if decoding a map16 packet will read outside the bounds of a buffer, resulting in a denial of service vulnerability.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libmsgpuck-dev · Ubuntu 18.04.6 LTS (bionic) | 1.0.3-1.1 | libmsgpuck-dev 1.0.3-1.1 | Dec 23, 2016 |
| libmsgpuck-dev · Ubuntu 20.04 LTS (focal) | 1.0.3-1.1 | libmsgpuck-dev 1.0.3-1.1 | Dec 23, 2016 |
| libmsgpuck-dev · Ubuntu 22.04.1 LTS (jammy) | 1.0.3-1.1 | libmsgpuck-dev 1.0.3-1.1 | Dec 23, 2016 |
| libmsgpuck-dev · Ubuntu 24.04.5 LTS (noble) | 1.0.3-1.1 | libmsgpuck-dev 1.0.3-1.1 | Dec 23, 2016 |