Boost
CVE-2016-9840
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
AnalysisAI
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 10.0%.
Technical ContextAI
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Affected products include: Boost, Zlib, Opensuse Leap, Opensuse, Debian Debian Linux.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
PHP Object Injection in the Boost plugin for WordPress (versions up to and including 2.0.3) allows unauthenticated remot
Unauthenticated SQL injection in the PixelYourSite "Boost" WordPress plugin (versions up to and including 2.0.4) lets re
Unauthenticated SQL injection in the PixelYourSite Boost plugin for WordPress (versions up to and including 2.0.3) allow
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated a
boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain i
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today