Candidate: CVE-2016-8339
PublicDate: 2016-10-28 14:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8339
 http://www.talosintelligence.com/reports/TALOS-2016-0206/
Description:
 A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code
 execution when a crafted command is sent. An out of bounds write
 vulnerability exists in the handling of the client-output-buffer-limit
 option during the CONFIG SET command for the Redis data structure store. A
 crafted CONFIG SET command can lead to an out of bounds write potentially
 resulting in code execution.
Ubuntu-Description:
Notes:
 leosilva> according with notes in upstream patch versions are affected
 leosilva> only after 3.2.
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_redis:
 other: https://github.com/antirez/redis/commit/6d9f8e2462fc2c426d48c941edeb78e5df7d2977
upstream_redis: released (3:3.2.4-1)
precise_redis: ignored (reached end-of-life)
precise/esm_redis: DNE (precise was needs-triage)
trusty_redis: not-affected
trusty/esm_redis: not-affected
vivid/stable-phone-overlay_redis: DNE
vivid/ubuntu-core_redis: DNE
xenial_redis: not-affected
yakkety_redis: ignored (reached end-of-life)
zesty_redis: ignored (reached end-of-life)
artful_redis: ignored (reached end-of-life)
bionic_redis: not-affected (5:4.0.9-1)
devel_redis: not-affected (5:4.0.11-2)