CVE-2016-9959 - OpenCVE

game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Suse	Linux Enterprise Software Development Kit Linux Enterprise Desktop Suse Linux Enterprise Server Linux Enterprise Workstation Extension Linux Enterprise
Opensuse	Leap Opensuse
Game-music-emu Project	Game-music-emu
Opensuse Project	Leap

Configuration 1 [-]

OR	cpe:2.3:o:opensuse:leap:42.2:::::::*
	cpe:2.3:o:opensuse:opensuse:12.1:::::::*
	cpe:2.3:o:opensuse_project:leap:42.1:::::::*
	cpe:2.3:o:suse:linux_enterprise:12.0:::::::*
	cpe:2.3:o:suse:linux_enterprise_desktop:12:::::::*
	cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:::::::*
	cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:::::::*
	cpe:2.3:o:suse:suse_linux_enterprise_server:12:::::::*

Configuration 2 [-]

cpe:2.3:a:game-music-emu_project:game-music-emu:*:*:*:*:*:*:*:*

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00090.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00005.html	Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/15/11	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/95305	Third Party Advisory VDB Entry
https://bitbucket.org/mpyne/game-music-emu/wiki/Home	Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LKMKVYS7AVB2EXC463FUYN6C6FABHME/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7Z2OVERYM6NW3FGVGTJUNSL5ZNFSH2S/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHAQI5Q2XDSPGRRKPJJM3A73VWAFSFL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFKIFSFIDXOKFUKAH2MBNXDTY6DYBF6/
https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html	Exploit Technical Description Third Party Advisory
https://security.gentoo.org/glsa/201707-02

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: debian

Published: 2017-04-12T20:00:00

Updated: 2017-07-10T09:57:01

Reserved: 2016-12-15T00:00:00

Link: CVE-2016-9959

JSON object: View

NVD Information

Status : Modified

Published: 2017-04-12T20:59:00.683

Modified: 2023-11-07T02:37:40.130

Link: CVE-2016-9959

JSON object: View

Redhat Information

No data.

CWE

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-12-14T00:00:00", "descriptions": [{"lang": "en", "value": "game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-10T09:57:01", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"name": "SUSE-SA:2016:3250", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00090.html"}, {"name": "FEDORA-2016-fbf9f8b204", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHAQI5Q2XDSPGRRKPJJM3A73VWAFSFL/"}, {"name": "95305", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/95305"}, {"name": "[oss-security] 20161215 Re: CVE Request: Game Music Emulators: incorrect emulation of the SPC700 audio co-processor of SNES: arbitrary code execution via malformed SPC music file", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/12/15/11"}, {"tags": ["x_refsource_MISC"], "url": "https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html"}, {"name": "GLSA-201707-02", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201707-02"}, {"name": "FEDORA-2017-5bf9a268df", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7Z2OVERYM6NW3FGVGTJUNSL5ZNFSH2S/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bitbucket.org/mpyne/game-music-emu/wiki/Home"}, {"name": "FEDORA-2016-04383482b4", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LKMKVYS7AVB2EXC463FUYN6C6FABHME/"}, {"name": "FEDORA-2017-3d771a1702", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFKIFSFIDXOKFUKAH2MBNXDTY6DYBF6/"}, {"name": "openSUSE-SA:2017:0022", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00005.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "ID": "CVE-2016-9959", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "SUSE-SA:2016:3250", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00090.html"}, {"name": "FEDORA-2016-fbf9f8b204", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GGHAQI5Q2XDSPGRRKPJJM3A73VWAFSFL/"}, {"name": "95305", "refsource": "BID", "url": "http://www.securityfocus.com/bid/95305"}, {"name": "[oss-security] 20161215 Re: CVE Request: Game Music Emulators: incorrect emulation of the SPC700 audio co-processor of SNES: arbitrary code execution via malformed SPC music file", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/12/15/11"}, {"name": "https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html", "refsource": "MISC", "url": "https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html"}, {"name": "GLSA-201707-02", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201707-02"}, {"name": "FEDORA-2017-5bf9a268df", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7Z2OVERYM6NW3FGVGTJUNSL5ZNFSH2S/"}, {"name": "https://bitbucket.org/mpyne/game-music-emu/wiki/Home", "refsource": "CONFIRM", "url": "https://bitbucket.org/mpyne/game-music-emu/wiki/Home"}, {"name": "FEDORA-2016-04383482b4", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6LKMKVYS7AVB2EXC463FUYN6C6FABHME/"}, {"name": "FEDORA-2017-3d771a1702", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHFKIFSFIDXOKFUKAH2MBNXDTY6DYBF6/"}, {"name": "openSUSE-SA:2017:0022", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00005.html"}]}}}}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2016-9959", "datePublished": "2017-04-12T20:00:00", "dateReserved": "2016-12-15T00:00:00", "dateUpdated": "2017-07-10T09:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*", "matchCriteriaId": "1EA337A3-B9A3-4962-B8BD-8E0C7C5B28EB", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*", "matchCriteriaId": "EBB2C482-D2A4-48B3-ACE7-E1DFDCC409B5", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse_project:leap:42.1:*:*:*:*:*:*:*", "matchCriteriaId": "CF605E46-ADCE-45B3-BBBA-E593D3CEE2A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "CBC8B78D-1131-4F21-919D-8AC79A410FB9", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*", "matchCriteriaId": "F1EB0F28-F23A-4969-8A3E-66DA2EFA40C3", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*", "matchCriteriaId": "DB2A1559-651C-46B0-B436-8E03DC8A60D2", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:*:*:*:*:*:*:*", "matchCriteriaId": "9DFA18B6-2642-470A-A350-68947529EE5D", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*", "matchCriteriaId": "9C649194-B8C2-49F7-A819-C635EE584ABF", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:game-music-emu_project:game-music-emu:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACB689B9-F892-4232-808C-E55B2A678479", "versionEndIncluding": "0.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values."}, {"lang": "es", "value": "game-music-emu en versiones anteriores a 0.6.1 permite a los atacantes remotos generar valores fuera de los l\u00edmites de 8 bits."}], "id": "CVE-2016-9959", "lastModified": "2023-11-07T02:37:40.130", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-04-12T20:59:00.683", "references": [{"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00090.html"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00005.html"}, {"source": "security@debian.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/12/15/11"}, {"source": "security@debian.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/95305"}, {"source": "security@debian.org", "tags": ["Patch"], "url": "https://bitbucket.org/mpyne/game-music-emu/wiki/Home"}, {"source": "security@debian.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LKMKVYS7AVB2EXC463FUYN6C6FABHME/"}, {"source": "security@debian.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7Z2OVERYM6NW3FGVGTJUNSL5ZNFSH2S/"}, {"source": "security@debian.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHAQI5Q2XDSPGRRKPJJM3A73VWAFSFL/"}, {"source": "security@debian.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFKIFSFIDXOKFUKAH2MBNXDTY6DYBF6/"}, {"source": "security@debian.org", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://scarybeastsecurity.blogspot.in/2016/12/redux-compromising-linux-using-snes.html"}, {"source": "security@debian.org", "url": "https://security.gentoo.org/glsa/201707-02"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}