Vulnerability Description
An exploitable out-of-bounds array access vulnerability exists in the xrow_header_decode function of Tarantool 1.7.2.0-g8e92715. A specially crafted packet can cause the function to access an element outside the bounds of a global array that is used to determine the type of the specified key's value. This can lead to an out of bounds read within the context of the server. An attacker who exploits this vulnerability can cause a denial of service vulnerability on the server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tarantool | Tarantool | 1.7.2 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/95063Broken LinkThird Party AdvisoryVDB Entry
- http://www.talosintelligence.com/reports/TALOS-2016-0255/ExploitTechnical DescriptionThird Party Advisory
- http://www.securityfocus.com/bid/95063Broken LinkThird Party AdvisoryVDB Entry
- http://www.talosintelligence.com/reports/TALOS-2016-0255/ExploitTechnical DescriptionThird Party Advisory
FAQ
What is CVE-2016-9037?
CVE-2016-9037 is a vulnerability with a CVSS score of 7.5 (HIGH). An exploitable out-of-bounds array access vulnerability exists in the xrow_header_decode function of Tarantool 1.7.2.0-g8e92715. A specially crafted packet can cause the function to access an element ...
How severe is CVE-2016-9037?
CVE-2016-9037 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-9037?
Check the references section above for vendor advisories and patch information. Affected products include: Tarantool Tarantool.