CVE-2016-4912
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a...
CVE-2016-4912 is a high vulnerability (CVSS 7.5) in Openslp, published June 10, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.36%, the 92nd percentile. Fixed in openslp 2.0.0-5.1.mga5.
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
- Record
CVE-2016-4912- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
- Record
CVE-2016-4912- Updated
- 2026-11-02
EUVDEUVD-2016-5887 No score
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
- Record
EUVD-2016-5887- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m4qh-6ff4-g5xx
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a...
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
- Record
GHSA-m4qh-6ff4-g5xx- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVAZL-36966
CVE-2016-4912 affecting package openslp 2.0.0-26
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
- Record
AZL-36966- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-7319
CVE-2016-4912 affecting package openslp 2.0.0-26
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
- Record
AZL-7319- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2016-0222 No score
Updated openslp packages fix security vulnerability
A null pointer dereference vulnerability was found in function _xrealloc() in xlsp_xmalloc.c in OpenSLP. A remote attacker could potentially crash the server when large number of packets are sent (CVE-2016-4912).
- Record
MGASA-2016-0222- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10065-1 No score
openslp-2.0.0-8.1 on GA media
These are all security issues fixed in the openslp-2.0.0-8.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10065-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2661-1 No score
Security update for openslp
This update for openslp fixes two security issues and two bugs.
The following vulnerabilities were fixed:
- CVE-2016-4912: A remote attacker could have crashed the server with a large number of packages (bsc#980722)
- CVE-2016-7567: A remote attacker could cause a memory corruption having unspecified impact (bsc#1001600)
The following bugfix changes are included:
- bsc#994989: Removed convenience code as changes bytes in the message buffer breaking the verification code
- bsc#974655: Removed no longer needed slpd init file
- Record
SUSE-SU-2016:2661-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0100-1 No score
Security update for openslp
This update for openslp fixes two security issues and two bugs.
The following vulnerabilities were fixed:
- CVE-2016-4912: A remote attacker could have crashed the server with a large number of packages (bsc#980722)
- CVE-2016-7567: A remote attacker could cause a memory corruption having unspecified impact (bsc#1001600)
The following bugfix changes are included:
- bsc#994989: Removed convenience code as changes bytes in the message buffer breaking the verification code
- bsc#974655: Removed no longer needed slpd init file
- Record
SUSE-SU-2018:0100-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openslpAzure Linux:3 |
through 2.0.0-26 | None known |
openslpAzure Linux:2 |
through 2.0.0-26 | None known |
openslpMageia:5 |
before 2.0.0-5.1.mga5 | 2.0.0-5.1.mga5 |
openslpSUSE:Linux Enterprise Desktop 12 SP1 |
before 2.0.0-17.1 | 2.0.0-17.1 |
openslpSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 2.0.0-17.1 | 2.0.0-17.1 |
openslpSUSE:Linux Enterprise Server 12 SP1 |
before 2.0.0-17.1 | 2.0.0-17.1 |
openslpSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 2.0.0-17.1 | 2.0.0-17.1 |
openslpSUSE:Linux Enterprise Desktop 12 SP2 |
before 2.0.0-18.2.1 | 2.0.0-18.2.1 |
openslpSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 2.0.0-18.2.1 | 2.0.0-18.2.1 |
openslpSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 2.0.0-18.2.1 | 2.0.0-18.2.1 |
openslpSUSE:Linux Enterprise Server 12 SP2 |
before 2.0.0-18.2.1 | 2.0.0-18.2.1 |
openslpSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.0.0-18.2.1 | 2.0.0-18.2.1 |
openslpopenSUSE:Tumbleweed |
before 2.0.0-8.1 | 2.0.0-8.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=1329295
security.gentoo.org/glsa/201707-05
securitytracker.com/id/1035916
openwall.com/lists/oss-security/2016/05/18/6
nvd.nist.gov/vuln/detail/CVE-2016-4912
github.com/advisories/GHSA-m4qh-6ff4-g5xx
Show 12 moreShow less
advisories.mageia.org/MGASA-2016-0222.html
bugs.mageia.org/show_bug.cgi?id=18600
lists.fedoraproject.org/archives/list/[email protected]/thread/FGW44JV455TRJ2NZQTEP76JKMFFO2JGS
suse.com/support/update/announcement/2016/suse-su-20162661-1
bugzilla.suse.com/1001600