CVE-2016-10377 Integer overflow in n/a
Remote attackers can bypass access control lists in Open vSwitch by sending malformed IP packets that trigger an integer underflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10377?
CVE-2016-10377 is a high-severity vulnerability in n/a, published on 29 May 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in `lib/flow.c` in the function `miniflow_extract`, permitting remote bypass of the access control list enforced by the switch.
Weakness: CWE-119
Which versions are affected by CVE-2016-10377?
It affects 1 product.
Products include Openvswitch Openvswitch.
How do I fix CVE-2016-10377?
Upgrade to a fixed version.
Is CVE-2016-10377 being exploited?
There is no known exploitation of CVE-2016-10377 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2016-10377, GHSA-w6j4-9556-fjfj.