CVE-2016-8339

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-8339
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-8339.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-8339
Downstream
Related
Published
2016-10-28T14:59:01.603Z
Modified
2026-03-15T22:23:18.473872Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.

References

Affected packages

Git / github.com/antirez/redis

Affected ranges

Type
GIT
Repo
https://github.com/antirez/redis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6d9f8e2462fc2c426d48c941edeb78e5df7d2977
Type
GIT
Repo
https://github.com/redis/redis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7ca8fbabe2081b0c8f72074cdd8dd7ef1863b86c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
04c7261f03cc423bcc089b27b5a24ad260279b22
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7c6e288d76c976456e1e9e74af5d8a87d44f536b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
44bf2533cdb2d753316e654c1b6dfd2298841433
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.3"
        }
    ]
}

Affected versions

1.*
1.3.6
2.*
2.2-alpha0
2.2-alpha1
2.2-alpha2
2.2-alpha3
2.2-alpha4
2.2-alpha5
2.2-alpha6
2.2.0-rc1
2.3-alpha0
3.*
3.0-alpha0
3.2-rc1
3.2.0
3.2.0-rc2
3.2.0-rc3
v1.*
v1.3.10
v1.3.11
v1.3.12
v1.3.7
v1.3.8
v1.3.9
v2.*
v2.0.0-rc1
v2.1.1-watch
Other
vm-playpen
with-deprecated-diskstore

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-8339.json"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "target": {
            "file": "src/config.c",
            "function": "loadServerConfigFromString"
        },
        "source": "https://github.com/antirez/redis/commit/6d9f8e2462fc2c426d48c941edeb78e5df7d2977",
        "deprecated": false,
        "digest": {
            "function_hash": "288492418366398193303725864291513460548",
            "length": 20691.0
        },
        "id": "CVE-2016-8339-6d6491f2",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "src/config.c",
            "function": "configSetCommand"
        },
        "source": "https://github.com/antirez/redis/commit/6d9f8e2462fc2c426d48c941edeb78e5df7d2977",
        "deprecated": false,
        "digest": {
            "function_hash": "79753074659388814966259388123951702147",
            "length": 10836.0
        },
        "id": "CVE-2016-8339-755949fa",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "src/config.c"
        },
        "source": "https://github.com/antirez/redis/commit/6d9f8e2462fc2c426d48c941edeb78e5df7d2977",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "91929518650114403327479648356929727639",
                "303707289483299645619714070913754686532",
                "287044286968905208952100017543816714323",
                "28091040296025360747264416505429866000",
                "167937454072435407816312399222765377847",
                "149716668783901345383030198957770556016",
                "129673522462979996686646850885308060976",
                "146918925904832260602599581829556198245",
                "31366338915807168348761730859865025775"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2016-8339-9da90dd0",
        "signature_type": "Line"
    }
]