Review reviewHigh

CVE-2016-9840

CADRA, boost

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

PRIORITY ASSESSMENT

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability4.79%

Technical severityCVSS 8.8

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Product: CADRA, boost
Affected versions: < V2511, < 1.78.0, >= 1.2.0.6 < 1.2.9, 42.1, 42.2, 13.2, 8.0, 16.04, 18.04, 18c, 1.6.0, 1.7.0, 1.8.0, >= 5.5.0 <= 5.5.61, >= 5.6.0 <= 5.6.41, >= 5.7.0 <= 5.7.23, >= 8.0.0 <= 8.0.12, 5.8, 6.0, 7.0
Fixed versions: 1.78.0, 1.2.9, 11, 10.13.0, 11.0, 4, 4.8.2, 6.10.2, 7.6.0

Confirm exposure before applying a vendor-supported change.

1
Identify
Confirm that CADRA, boost and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.