CVE-2016-8859 — tre - security update

Description

Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggers an out-of-bounds write.

How to fix CVE-2016-8859

To remediate CVE-2016-8859, upgrade the affected package to a fixed version below.

Alpine/musl—upgrade to 1.1.15-r4 or later
—upgrade to 1.1.15-2 or later
—upgrade to 0.8.0-5 or later
—upgrade to 0.8.0-3+deb7u1 or later

Is CVE-2016-8859 being exploited?

Low — EPSS is 0.8%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

from 0, < 1.1.15-r4
from 0, < 1.1.15-2
from 0, < 0.8.0-5
from 0, < 0.8.0-3+deb7u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)

ADVISORYsecurity.alpinelinux.org/vuln/CVE-2016-8859
ADVISORYsecurity-tracker.debian.org/tracker/CVE-2016-8859