CVE-2016-6831
The "process-execute" and "process-spawn" procedures did not free memory correctly when the...
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
- Record
CVE-2016-6831- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
- Record
CVE-2016-6831- Updated
- 2026-11-02
EUVDEUVD-2016-7716 No score
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
- Record
EUVD-2016-7716- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x279-7m5p-wjmv
The "process-execute" and "process-spawn" procedures did not free memory correctly when the...
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
- Record
GHSA-x279-7m5p-wjmv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
- Record
CVE-2016-6831- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-6831
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
- Record
DEBIAN-CVE-2016-6831- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-6831
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
- Record
UBUNTU-CVE-2016-6831- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chickenDebian:12 |
before 4.12.0-0.2 | 4.12.0-0.2 |
chickenDebian:13 |
before 4.12.0-0.2 | 4.12.0-0.2 |
chickenDebian:14 |
before 4.12.0-0.2 | 4.12.0-0.2 |
chickenDebian:7 |
before 4.7.0-1+deb7u1, plus listed versions 4.7.0-1 |
4.7.0-1+deb7u1 |
chickenUbuntu:16.04:LTS |
All versions, plus listed versions 4.9.0.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-6831 is a high vulnerability (CVSS 7.5) in Call-cc Chicken, published September 30, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile. Fixed in chicken 4.12.0-0.2.
References
securityfocus.com/bid/92550
lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html
nvd.nist.gov/vuln/detail/CVE-2016-6831
github.com/advisories/GHSA-x279-7m5p-wjmv
security-tracker.debian.org/tracker/CVE-2016-6831
ubuntu.com/security/CVE-2016-6831
openwall.com/lists/oss-security/2016/08/18/2
cve.org/CVERecord?id=CVE-2016-6831