What is the CVSS score of CVE-2016-9841?

CVE-2016-9841 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 13.5%.

Zlib CVE-2016-9841

CRITICAL

2017-05-23 security@opentext.com

Information Disclosure Zlib Leap Opensuse Debian Linux Ubuntu Linux Database Server Jdk Jre MySQL Satellite Enterprise Linux Desktop Enterprise Linux Eus Enterprise Linux Server Enterprise Linux Workstation Iphone Os Mac Os X Tvos Watchos Active Iq Unified Manager Cloud Backup E Series Santricity Management E Series Santricity Os Controller E Series Santricity Storage Manager E Series Santricity Web Services Oncommand Balance Oncommand Insight Oncommand Performance Manager Oncommand Shift Oncommand Unified Manager Oncommand Workflow Automation Snapmanager Solidfire Steelstore Cloud Integrated Storage Storage Replication Adapter For Clustered Data Ontap Symantec Netbackup Vasa Provider For Clustered Data Ontap Virtual Storage Console Hci Storage Node Node Js

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 23, 2017 - 04:29 cve.org

CRITICAL 9.8

DescriptionNVD

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

AnalysisAI

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 13.5% and no vendor patch available.

Technical ContextAI

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Affected products include: Zlib, Opensuse Leap, Opensuse, Debian Debian Linux, Canonical Ubuntu Linux.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.