CVE-2016-8606
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via...
CVE-2016-8606 is a critical vulnerability (CVSS 9.8) in Gnu Guile, published October 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.22%, the 91st percentile. Fixed in guile 2.0.11-r3.
- Severity
- 9.8 CriticalCVSS 3.0, NVD
- Exploit chance
- 4.22%EPSS, 91st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.11-r3guile +4 more
Description
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
guileAlpine:v3.4 | before 2.0.11-r3 | 2.0.11-r3 |
guile-2.0Debian:7 From an advisory covering 2 CVEs | before 2.0.5+1-3+deb7u1, plus listed versions 2.0.5+1-3 | 2.0.5+1-3+deb7u1 |
guileMageia:5 From an advisory covering 2 CVEs | before 2.0.13-1.mga5 | 2.0.13-1.mga5 |
guile-2.0Ubuntu:16.04:LTS | All versions, plus listed versions 2.0.11+1-9ubuntu12.0.11+1-102.0.11+1-10ubuntu0.1 | None known |
guileopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 2.0.13-2.1 | 2.0.13-2.1 |
What each source reports
NVD Score used
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
- Record
CVE-2016-8606- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE ListNo score
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
- Record
CVE-2016-8606- Updated
- 2026-11-02
EUVDEUVD-2016-9453No score
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
- Record
EUVD-2016-9453- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vqrx-mf37-8x6h
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via...
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
- Record
GHSA-vqrx-mf37-8x6h- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-8606
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
- Record
ALPINE-CVE-2016-8606- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
- Record
CVE-2016-8606- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-8606
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
- Record
UBUNTU-CVE-2016-8606- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0354No score
Updated guile packages fix security vulnerability
The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process’ umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions (CVE-2016-8605).
GNU Guile, an implementation of the Scheme language, provides a “REPL server” which is a command prompt that developers can connect to for live coding and debugging purposes. The REPL server is vulnerable to the HTTP inter-protocol attack. This constitutes a remote code execution vulnerability for developers running a REPL server that listens on a loopback device or private network (CVE-2016-8606).
The guile package has been updated to version 2.0.13, fixing these issues and other bugs. See the upstream release announcements for details.
- Record
MGASA-2016-0354- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10389-1No score
guile-2.0.13-2.1 on GA media
These are all security issues fixed in the guile-2.0.13-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10389-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QTAGSDCTYXTABAA77BQJGNKOOBRV4DK
openwall.com/lists/oss-security/2016/10/12/2
securityfocus.com/bid/93514
nvd.nist.gov/vuln/detail/CVE-2016-8606
Show 13 moreShow less
github.com/advisories/GHSA-vqrx-mf37-8x6h
security.alpinelinux.org/vuln/CVE-2016-8606
advisories.mageia.org/MGASA-2016-0354.html
bugs.mageia.org/show_bug.cgi?id=19567
lwn.net/Vulnerabilities/703769
ubuntu.com/security/CVE-2016-8606
cve.org/CVERecord?id=CVE-2016-8606
suse.com/security/cve/CVE-2016-8605