CVE-2016-9427
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of...
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
- Record
CVE-2016-9427- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119, CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
- Record
CVE-2016-9427- Updated
- 2026-11-02
EUVDEUVD-2016-10237 No score
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
- Record
EUVD-2016-10237- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mg78-4mqg-2c9m
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of...
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
- Record
GHSA-mg78-4mqg-2c9m- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
- Record
CVE-2016-9427- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-9427
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
- Record
DEBIAN-CVE-2016-9427- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2016-9427
Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
- Record
UBUNTU-CVE-2016-9427- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0157 No score
Updated gc packages fix security vulnerability
Kuang-che Wu discovered that multiple integer overflow vulnerabilities existed in libgc. An attacker could use these to cause a denial of service (application crash) or possibly execute arbitrary code (CVE-2016-9427).
- Record
MGASA-2017-0157- Updated
- 2026-11-02
OSVMGASA-2018-0024 No score
Updated w3m packages fix security vulnerability
The w3m package has been updated to a newer git snapshot to fix several security issues.
- Record
MGASA-2018-0024- Updated
- 2026-11-02
OSVSUSE-SU-2016:3057-1 No score
Security update for gc
This update for gc fixes the following issues:
- integer overflow in GC_MALLOC_ATOMIC() (CVE-2016-9427, bsc#1011276)
- Record
SUSE-SU-2016:3057-1- Updated
- 2026-11-02
OSVUSN-3197-1 No score
libgc vulnerability
Kuang-che Wu discovered that multiple integer overflow vulnerabilities existed in libgc. An attacker could use these to cause a denial of service (application crash) or possibly execute arbitrary code.
- Record
USN-3197-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgcDebian:12 |
before 1:7.6.4-0.3 | 1:7.6.4-0.3 |
libgcDebian:13 |
before 1:7.6.4-0.3 | 1:7.6.4-0.3 |
libgcDebian:14 |
before 1:7.6.4-0.3 | 1:7.6.4-0.3 |
libgcDebian:9 |
before 1:7.4.2-8+deb9u1, plus listed versions 1:7.4.2-8 |
1:7.4.2-8+deb9u1 |
libgcDebian:7 |
before 1:7.1-9.1+deb7u1, plus listed versions 1:7.1-9.1 |
1:7.1-9.1+deb7u1 |
gcMageia:5 |
before 7.4.2-3.1.mga5 | 7.4.2-3.1.mga5 |
w3mMageia:5 |
before 0.5.3-8.2.mga5 | 0.5.3-8.2.mga5 |
gcSUSE:Linux Enterprise Desktop 12 SP1 |
before 7.2d-5.1 | 7.2d-5.1 |
gcSUSE:Linux Enterprise Desktop 12 SP2 |
before 7.2d-5.1 | 7.2d-5.1 |
gcSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 7.2d-5.1 | 7.2d-5.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gcSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 7.2d-5.1 | 7.2d-5.1 |
gcSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 7.2d-5.1 | 7.2d-5.1 |
gcSUSE:Linux Enterprise Server 12 SP1 |
before 7.2d-5.1 | 7.2d-5.1 |
gcSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 7.2d-5.1 | 7.2d-5.1 |
gcSUSE:Linux Enterprise Server 12 SP2 |
before 7.2d-5.1 | 7.2d-5.1 |
gcSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 7.2d-5.1 | 7.2d-5.1 |
libgcUbuntu:14.04:LTS |
before 1:7.2d-5ubuntu2.1, plus listed versions 1:7.2d-5ubuntu11:7.2d-5ubuntu2 |
1:7.2d-5ubuntu2.1 |
libgcUbuntu:16.04:LTS |
before 1:7.4.2-7.3ubuntu0.1, plus listed versions 1:7.2d-6.41:7.4.2-71:7.4.2-7.11:7.4.2-7.21:7.4.2-7.3 |
1:7.4.2-7.3ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-9427 is a critical vulnerability (CVSS 9.8) in Bdwgc Project Bdwgc, published November 25, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.14%, the 90th percentile. Fixed in libgc 1:7.6.4-0.3.
References
lists.opensuse.org/opensuse-updates/2016-12/msg00089.html
github.com/ivmai/bdwgc/issues/135
securityfocus.com/bid/94407
openwall.com/lists/oss-security/2016/11/18/3
lists.debian.org/debian-lts-announce/2022/03/msg00039.html
Show 18 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-9427
security-tracker.debian.org/tracker/CVE-2016-9427
advisories.mageia.org/MGASA-2017-0157.html
bugs.mageia.org/show_bug.cgi?id=19844
ubuntu.com/usn/usn-3197-1
openwall.com/lists/oss-security/2016/11/24/1
suse.com/support/update/announcement/2016/suse-su-20163057-1
bugzilla.suse.com/1011276
ubuntu.com/security/CVE-2016-9427
cve.org/CVERecord?id=CVE-2016-9427