Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade memcached | Sep 20, 2017 | Jan 6, 2017 |
| Amazon_linux | — | Upgrade memcached | Nov 11, 2016 | Nov 10, 2016 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 6, 2017 |
| Centos_linux | — | Upgrade memcached-develUpgrade memcached | Jan 27, 2017 | Nov 28, 2016 |
| Debian | — | Upgrade memcached | Nov 3, 2016 | Nov 3, 2016 |
| Freebsd | — | Upgrade memcached | Nov 14, 2016 | Nov 2, 2016 |
| Gentoo Linux | — | Upgrade net-misc/memcached. | Oct 30, 2017 | Jan 6, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade memcached | Nov 30, 2017 | Jan 6, 2017 |
| Oracle Solaris | — | Upgrade service/memcached to version 1.5.11-11.4.5.0.1.2.0 on Solaris 11.4Upgrade service/memcached to version 1.4.33-0.175.3.16.0.3.0 on Solaris 11.3 | May 29, 2017 | Jan 6, 2017 |
| Oracle_linux | — | Upgrade memcachedUpgrade memcached-devel | Nov 23, 2016 | Oct 31, 2016 |
| Redhat_linux | — | Upgrade memcached-develUpgrade memcached-debuginfoUpgrade memcached | Nov 23, 2016 | Nov 23, 2016 |
| Suse | — | Upgrade memcached-develUpgrade memcached | Jan 6, 2017 | Jan 6, 2017 |
| Ubuntu | — | Upgrade memcached | Nov 3, 2016 | Nov 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub