CVE-2016-9840
Node.js 4 and 1 other: inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging…
CVE-2016-9840 is fixed in 5 products on 2 platforms, first by klibc-utils 2.0.13-4ubuntu1, released May 22, 2017. 1 other affected product has no fix yet. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
8.8
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0488
92nd percentile
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.8.6 | Node.js 4 4.8.6 | Nov 6, 2017 |
| Linux | |||
| klibc-utils · Ubuntu 18.04.6 LTS (bionic) | 2.0.4-9ubuntu2.2+esm1 | klibc-utils 2.0.4-9ubuntu2.2+esm1 | Aug 5, 2022 |
| klibc-utils · Ubuntu 20.04 LTS (focal) | 2.0.7-1ubuntu5.2 | klibc-utils 2.0.7-1ubuntu5.2 | Aug 5, 2022 |
| klibc-utils · Ubuntu 22.04.1 LTS (jammy) | 2.0.10-4ubuntu0.1 | klibc-utils 2.0.10-4ubuntu0.1 | Aug 5, 2022 |
| klibc-utils · Ubuntu 24.04.5 LTS (noble) | 2.0.13-4ubuntu0.1 | klibc-utils 2.0.13-4ubuntu0.1 | Aug 5, 2022 |
| klibc-utils · Ubuntu 24.10 (oracular) | 2.0.13-4ubuntu1 | klibc-utils 2.0.13-4ubuntu1 | Jan 16, 2026 |
| klibc-utils · Ubuntu 25.04 (plucky) | 2.0.13-4ubuntu1 | klibc-utils 2.0.13-4ubuntu1 | Jan 16, 2026 |
| klibc-utils · Ubuntu 25.10 (questing) | 2.0.13-4ubuntu1 | klibc-utils 2.0.13-4ubuntu1 | May 22, 2017 |
| libklibc · Ubuntu 18.04.6 LTS (bionic) | 2.0.4-9ubuntu2.2+esm1 | libklibc 2.0.4-9ubuntu2.2+esm1 | Aug 5, 2022 |
| libklibc · Ubuntu 20.04 LTS (focal) | 2.0.7-1ubuntu5.2 | libklibc 2.0.7-1ubuntu5.2 | Aug 5, 2022 |
| libklibc · Ubuntu 22.04.1 LTS (jammy) | 2.0.10-4ubuntu0.1 | libklibc 2.0.10-4ubuntu0.1 | Aug 5, 2022 |
| libklibc · Ubuntu 24.04.5 LTS (noble) | 2.0.13-4ubuntu0.1 | libklibc 2.0.13-4ubuntu0.1 | Aug 5, 2022 |
| libklibc · Ubuntu 24.10 (oracular) | 2.0.13-4ubuntu1 | libklibc 2.0.13-4ubuntu1 | Jan 16, 2026 |
| libklibc · Ubuntu 25.04 (plucky) | 2.0.13-4ubuntu1 | libklibc 2.0.13-4ubuntu1 | Jan 16, 2026 |
| libklibc · Ubuntu 25.10 (questing) | 2.0.13-4ubuntu1 | libklibc 2.0.13-4ubuntu1 | May 22, 2017 |
| rsync · RHEL 8 | 0:3.1.3-23.el8_10 | RHSA-2025:8395 | Jun 2, 2025 |
| rsync · Ubuntu 18.04.6 LTS (bionic) | 3.1.2-2.1ubuntu1.1 | rsync 3.1.2-2.1ubuntu1.1 | May 22, 2017 |
| rsync · Ubuntu 20.04 LTS (focal) | 3.1.3-6 | rsync 3.1.3-6 | May 22, 2017 |
| rsync · Ubuntu 24.10 (oracular) | 3.1.3-6 | rsync 3.1.3-6 | Jan 16, 2026 |
| rsync · Ubuntu 25.04 (plucky) | 3.1.3-6 | rsync 3.1.3-6 | Jan 16, 2026 |
| rsync-daemon · RHEL 8 | 0:3.1.3-23.el8_10 | RHSA-2025:8395 | Jun 2, 2025 |
| No fix yet | |||
| Node.js 7 (Windows apps) | No fix yet | no-fix | n/a |