CVE-2016-6188 — Missing Release of Memory after Effective Lifetime in Sogo

CWE-3995 documents5 sources

Severity

6.5MEDIUMNVD

EPSS

1.5%

top 18.74%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Alinto Sogo

Timeline

PublishedFeb 3

Latest updateMay 13

Description

Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to temporary files.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶Debianalinto/sogo< 3.2.4-0.2+3

▶NVDalinto/sogo2.3.7

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

GHSA

GHSA-5wc3-v5wf-mg8q: Memory leak in SOGo 2↗2022-05-13

▶

OSV

CVE-2016-6188: Memory leak in SOGo 2↗2017-02-03

▶

CVEList

CVE-2016-6188: Memory leak in SOGo 2↗2017-02-03

▶

📋Vendor Advisories

Debian

CVE-2016-6188: sogo - Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (...↗2016

▶