Vulnerability Details : CVE-2016-8386
An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a PDF containing a malformed font to XML, the tool will attempt to use a size out of the font to search through a linked list of buffers to return. Due to a signedness issue, a buffer smaller than the requested size will be returned. Later when the tool tries to populate this buffer, the overflow will occur which can lead to code execution under the context of the user running the tool.
Vulnerability category: OverflowMemory Corruption
Products affected by CVE-2016-8386
- cpe:2.3:a:iceni:argus:6.6.04:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-8386
0.23%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 61 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-8386
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
Talos | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2016-8386
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-8386
-
http://www.talosintelligence.com/reports/TALOS-2016-0211/
TALOS-2016-0211 || Cisco Talos Intelligence Group - Comprehensive Threat IntelligenceExploit;Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/96472
Iceni Argus Multiple Security VulnerabilitiesBroken Link;Third Party Advisory;VDB Entry
Jump to