CVE-2016-10739 describes a vulnerability in the GNU C Library (glibc) through version 2.28, where the getaddrinfo function incorrectly parses IPv4 addresses followed by whitespace and arbitrary characters, potentially leading applications to misinterpret invalid strings as valid. This medium-severity vulnerability (CVSS 5.3) has a local attack vector, low attack complexity, and could result in low impacts to confidentiality, integrity, and availability. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.28CPE matchmatch criteria | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* | ||
15.0CPE matchmatch criteria | cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2016-10739
Aug 11, 2020In the GNU C Library (aka glibc or libc6) through 2.28 the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters which could lead applications to incorrectly assume that it had parsed a valid string without the possibility of embedded HTTP headers or other potentially dangerous substrings.
Jan 8, 2019glibc: getaddrinfo should reject IP addresses with trailing characters
Apr 28, 2016