Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggers an out-of-bounds write.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade musl | Aug 22, 2024 | Feb 13, 2017 |
| Debian | — | Upgrade muslUpgrade tre | Mar 31, 2017 | Oct 27, 2016 |
| Gentoo Linux | — | Upgrade sys-libs/musl.Upgrade dev-libs/tre. | Oct 30, 2017 | Feb 13, 2017 |
| Suse | — | Upgrade kubernetes-kubelet-commonUpgrade go1.14Upgrade kubernetes-masterUpgrade kubernetes-controller-managerUpgrade kubernetes-apiserverUpgrade cri-toolsUpgrade kubernetes-schedulerUpgrade kubernetes-proxyUpgrade go1.14-docUpgrade kubernetes-kubelet1.18Upgrade kubernetes-clientUpgrade kubernetes-nodeUpgrade cri-oUpgrade kubernetes-kubeadmUpgrade go1.14-raceUpgrade kubernetes-kubelet1.17Upgrade cri-o-kubeadm-criconfig | Jan 26, 2018 | Feb 13, 2017 |
| Ubuntu | — | Upgrade musl (Ubuntu Pro) | Mar 22, 2023 | Feb 13, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub