CVE-2016-10196
HIGH 7.5EPSS 5.2%
Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P - EPSS
- 5.21% chance of exploitation in the next 30 days, 92nd percentile
- Published
- 2017-03-15
- Updated
- 2024-08-06
Proof-of-concept exploits (1)
- libevent/libevent/issues/31811966★ · 2026-09-01
Security advisories
- http://www.debian.org/security/2017/dsa-3789
- http://www.openwall.com/lists/oss-security/2017/01/31/17
- http://www.openwall.com/lists/oss-security/2017/02/02/7
- http://www.securityfocus.com/bid/96014
- http://www.securitytracker.com/id/1038320
- https://access.redhat.com/errata/RHSA-2017:1104
- https://access.redhat.com/errata/RHSA-2017:1106
- https://access.redhat.com/errata/RHSA-2017:1201
- https://bugzilla.mozilla.org/show_bug.cgi?id=1343453
- https://security.gentoo.org/glsa/201705-01
- https://www.mozilla.org/security/advisories/mfsa2017-10
- https://www.mozilla.org/security/advisories/mfsa2017-11
- https://www.mozilla.org/security/advisories/mfsa2017-12
- https://www.mozilla.org/security/advisories/mfsa2017-13