Every CVE Search/ Get API key

CVE-2016-9888

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured...

5.5 MediumFix available

CVE-2016-9888 is a medium vulnerability (CVSS 5.5) in Gnome Libgsf, published December 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in libgsf 1.14.41-r0.

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.33%Up 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Record
CVE-2016-9888
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Record
CVE-2016-9888
Updated
2026-11-02
EUVDEUVD-2016-10677 No score

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Record
EUVD-2016-10677
Updated
2026-11-03
GitHub AdvisoriesGHSA-7j73-f8pw-v3wq 5.5

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured...

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Record
GHSA-7j73-f8pw-v3wq
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2016-9888 5.5

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Record
ALPINE-CVE-2016-9888
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.5

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Record
CVE-2016-9888
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2016-9888 5.5

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Record
DEBIAN-CVE-2016-9888
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-9888 5.5

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Record
UBUNTU-CVE-2016-9888
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2016-0427 No score

Updated libgsf packages fix security vulnerability

An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file (CVE-2016-9888).

Record
MGASA-2016-0427
Updated
2026-11-02
OSVSUSE-SU-2024:3770-1 No score

Security update for libgsf

This update for libgsf fixes the following issues:

  • CVE-2016-9888: Fixed null pointer dereference with corrupted tar files (bsc#1014609)
  • CVE-2024-36474: Fixed out-of-bounds index when processing a directory via an integer overflow in the compound document binary file format parser (bsc#1231282)
  • CVE-2024-42415: Fixed heap-based buffer overflow when processing the sector allocation table via an integer overflow in the compound document binary file format parser (bsc#1231283)
Record
SUSE-SU-2024:3770-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libgsf
Alpine:v3.10
 before 1.14.41-r0
1.14.41-r0
libgsf
Alpine:v3.11
 before 1.14.41-r0
1.14.41-r0
libgsf
Alpine:v3.2
 before 1.14.41-r0
1.14.41-r0
libgsf
Alpine:v3.3
 before 1.14.41-r0
1.14.41-r0
libgsf
Alpine:v3.4
 before 1.14.41-r0
1.14.41-r0
libgsf
Alpine:v3.5
 before 1.14.41-r0
1.14.41-r0
libgsf
Alpine:v3.6
 before 1.14.41-r0
1.14.41-r0
libgsf
Alpine:v3.7
 before 1.14.41-r0
1.14.41-r0
libgsf
Alpine:v3.8
 before 1.14.41-r0
1.14.41-r0
libgsf
Alpine:v3.9
 before 1.14.41-r0
1.14.41-r0
Show 10 moreShow less
Affected packages
PackageAffectedFixed
libgsf
Debian:12
 before 1.14.41-1
1.14.41-1
libgsf
Debian:13
 before 1.14.41-1
1.14.41-1
libgsf
Debian:14
 before 1.14.41-1
1.14.41-1
libgsf
Debian:8
 before 1.14.30-2+deb8u1, plus listed versions
1.14.30-2
1.14.30-2+deb8u1
libgsf
Debian:7
 before 1.14.21-2.1+deb7u1, plus listed versions
1.14.21-2.1
1.14.21-2.1+deb7u1
libgsf
Mageia:5
 before 1.14.31-1.1.mga5
1.14.31-1.1.mga5
libgsf
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 1.14.40-8.3.1
1.14.40-8.3.1
libgsf
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.14.40-8.3.1
1.14.40-8.3.1
libgsf
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.14.27-2ubuntu11.14.27-2ubuntu2
 None known
libgsf
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.14.34-11.14.34-21.14.35-11.14.36-1
 None known

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open