CVE-2016-8606
critical
CVSS v3
9.8
CVSS v2
7.5
VIR risk
9.8
Description
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2016-8606.html
Vendor advisory: cve@mitre.org — http://www.openwall.com/lists/oss-security/2016/10/12/2
Vendor advisory: arch — https://security.archlinux.org/ASA-201610-10
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| arch | fixed | 2.0.13-1 | |
| fedora | 23 | affected | |
| fedora | 24 | affected | |
| fedora | 25 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| gnu | guile | 2.0.12 | |
References
- https://security.archlinux.org/ASA-201610-10
- http://www.openwall.com/lists/oss-security/2016/10/12/2
- http://www.securityfocus.com/bid/93514
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QTAGSDCTYXTABAA77BQJGNKOOBRV4DK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNVE5N24FLWDYBQ3LAFMF6BFCWKDO7VM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJP5S36GTXMDEBXWF6LKKV76DSLNQG44/
- https://www.suse.com/security/cve/CVE-2016-8606.html
CWEs
CWE-284
Verify integrity in audit chain (admin only). AS-IS.