Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-6855 — Out-of-bounds Write in EYE OF Gnome

CWE-787 — Out-of-bounds Write9 documents8 sources
Severity
7.5HIGHNVD
EPSS
4.0%
top 11.49%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
7
Gnome EOGDebian EOGCanonical Ubuntu Linux+4 more
Timeline
PublishedSep 7
Latest updateMay 14

Description

Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Debiangnome/eog< 3.20.4-1+3
▶NVDgnome/eye_of_gnome21 versions+20
▶debiandebian/eog< eog 3.20.4-1 (bookworm)
▶NVDopensuse/leap42.1

Also affects: Fedora 23, 24, Ubuntu Linux 12.04, 14.04, 16.04

Patches

Patch: git.gnome.org ↗Patch: git.gnome.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-7jwp-58q4-9rxh: Eye of GNOME (aka eog) 3↗2022-05-14
▶
OSV
CVE-2016-6855: Eye of GNOME (aka eog) 3↗2016-09-07
▶

💥Exploits & PoCs

1
Exploit-DB
Eye of Gnome 3.10.2 - GMarkup Out of Bounds Write↗2016-08-23
▶

📋Vendor Advisories

3
Ubuntu
Eye of GNOME vulnerability↗2016-08-25
▶
Red Hat
eog: Out-of-bounds write when passing invalid UTF-8 to GMarkup↗2016-08-19
▶
Debian
CVE-2016-6855: eog - Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x ...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-6855 eog: Out-of-bounds write when passing invalid UTF-8 to GMarkup↗2016-08-22
▶
Bugzilla
CVE-2016-6855 eog: Out-of-bounds write when passing invalid UTF-8 to GMarkup [fedora-all]↗2016-08-22
▶