CVE-2016-10739
Severity
5.3MEDIUM
EPSS
0.0%
top 87.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 21
Latest updateMay 14
Description
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 1.8 | Impact: 3.4
Affected Packages3 packages
Patches
🔴Vulnerability Details
3📋Vendor Advisories
5Microsoft▶
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter as demonstrated by the first↗2019-10-08
Microsoft▶
In the GNU C Library (aka glibc or libc6) through 2.28 the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters which c↗2019-01-08
Debian▶
CVE-2016-10739: glibc - In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function...↗2016