{"id":"CVE-2016-4804","aliases":["DEBIAN-CVE-2016-4804","DLA-2224-1","DLA-474-1","EUVD-2016-5787","GHSA-q73q-vv6v-g3cp","MGASA-2016-0184","SUSE-SU-2016:2145-1","SUSE-SU-2016:2146-1","UBUNTU-CVE-2016-4804","USN-2986-1"],"status":"published","title":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of...","description":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.","severity":{"version":"3.0","score":6.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00448,"percentile":0.39172,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-05-15T00:00:00Z","modified":"2026-10-20T13:15:39Z","fixes":[{"ecosystem":"Debian:12","package":"dosfstools","fixed_in":["4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dosfstools","fixed_in":["4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dosfstools","fixed_in":["4.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"dosfstools","fixed_in":["3.0.26-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"dosfstools","fixed_in":["3.0.28-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.27-1+deb8u1"}]}],"versions":["3.0.27-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-1+deb7u1"}]}],"versions":["3.0.13-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.27-1.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-6.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-6.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-6.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-1ubuntu0.1"}]}],"versions":["3.0.16-2ubuntu2","3.0.24-1","3.0.25-1","3.0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.28-2ubuntu0.1"}]}],"versions":["3.0.28-1","3.0.28-2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-1ubuntu0.1"}]}],"versions":["3.0.16-2ubuntu2","3.0.24-1","3.0.25-1","3.0.26-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dosfstools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.28-2ubuntu0.1"}]}],"versions":["3.0.28-1","3.0.28-2"],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"dosfstools_project","product":"dosfstools"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2016-06/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://github.com/dosfstools/dosfstools/issues/25","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://blog.fuzzing-project.org/44-dosfstools-fsck.vfat-Several-invalid-memory-accesses.html","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"http://www.ubuntu.com/usn/USN-2986-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://github.com/dosfstools/dosfstools/issues/26","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-09/msg00014.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/90311","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://github.com/dosfstools/dosfstools/commit/e8eff147e9da1185f9afd5b25948153a3b97cf52","tags":["x_refsource_CONFIRM","x_transferred","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4804"},{"url":"https://github.com/advisories/GHSA-q73q-vv6v-g3cp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4804","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0184.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18462","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/05/14/1","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162145-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/912607","tags":["report"]},{"url":"https://bugzilla.suse.com/980364","tags":["report"]},{"url":"https://bugzilla.suse.com/980377","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4804","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162146-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-4804","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2986-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8872","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4804","description":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.","status":"published","published":"2016-06-03T14:00:00Z","modified":"2024-08-06T00:39:26.3Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2016-5787","description":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.","status":"published","published":"2016-06-03T14:00:00Z","modified":"2024-08-06T00:39:26Z","updated_at":"2026-11-03T02:22:44.916959Z"}],"ghsa":[{"id":"GHSA-q73q-vv6v-g3cp","title":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of...","description":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.","status":"published","published":"2022-05-13T01:26:12Z","modified":"2023-02-01T05:07:29Z","cvss":[{"version":"3.0","score":6.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:32.865918Z"}],"nvd":[{"id":"CVE-2016-4804","description":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.","status":"published","published":"2016-06-03T14:59:06.263Z","modified":"2026-06-17T00:48:14.797Z","cvss":[{"version":"3.0","score":6.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-4804","description":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.","status":"published","published":"2016-06-03T14:59:06.263Z","modified":"2026-10-20T13:15:39.208907071Z","cvss":[{"version":"3.0","score":6.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4804","description":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.","status":"published","published":"2016-06-03T14:59:06.263Z","modified":"2026-09-22T07:03:00.452384258Z","cvss":[{"version":"3.0","score":6.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4804","description":"The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.","status":"published","published":"2016-05-19T00:00:00Z","modified":"2026-02-04T03:09:35.188134Z","cvss":[{"version":"3.0","score":6.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-2224-1","title":"dosfstools - security update","status":"published","published":"2020-05-30T00:00:00Z","modified":"2026-03-09T01:18:02.119173Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-474-1","title":"dosfstools - security update","status":"published","published":"2016-05-15T00:00:00Z","modified":"2026-03-09T02:11:32.98093Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0184","title":"Updated dosfstools packages fix security vulnerabilities","description":"Updated dosfstools package fixes security vulnerabilities:\n\nIn dosfstools before 4.0, if the third to last entry was written on a FAT12\nfilesystem with an odd number of clusters, the second to last entry would be\ncorrupted. This corruption may also lead to invalid memory accesses when the\ncorrupted entry becomes out of bounds and is used later (CVE-2015-8872).\n\nIn dosfstools before 4.0, the variable used for storing the FAT size (in bytes)\nwas an unsigned int. Since the size in sectors read from the BPB was not\nsufficiently checked, this could end up being zero after multiplying it with\nthe sector size while some offsets still stayed excessive. Ultimately it would\ncause segfaults when accessing FAT entries for which no memory was allocated\n(CVE-2016-4804).\n","status":"published","published":"2016-05-18T20:14:22Z","modified":"2026-04-16T06:24:10.784226184Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"SUSE-SU-2016:2145-1","title":"Security update for dosfstools","description":"dosfstools was updated to fix two security issues.\n\nThese security issues were fixed:\n- CVE-2015-8872: The set_fat function in fat.c in dosfstools might have allowed attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an 'off-by-two error (bsc#980364).\n- CVE-2016-4804: The read_boot function in boot.c in dosfstools allowed attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function (bsc#980377).\n\nThis non-security issue was fixed:\n- bsc#912607: Attempt to rename root dir in fsck due to uninitialized fields.\n  ","status":"published","published":"2016-08-24T11:55:45Z","modified":"2026-02-04T04:02:06.220751Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2146-1","title":"Security update for dosfstools","description":"dosfstools was updated to fix two security issues.\n\nThese security issues were fixed:\n- CVE-2015-8872: The set_fat function in fat.c in dosfstools might have allowed attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an 'off-by-two error (bsc#980364).\n- CVE-2016-4804: The read_boot function in boot.c in dosfstools allowed attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function (bsc#980377).\n  ","status":"published","published":"2016-08-24T11:55:12Z","modified":"2026-02-04T03:37:38.277043Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-2986-1","title":"dosfstools vulnerabilities","description":"Hanno Böck discovered that dosfstools incorrectly handled certain malformed\nfilesystems. A local attacker could use this issue to cause dosfstools to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2016-05-31T15:04:24Z","modified":"2026-02-10T04:40:59Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}