{"id":"CVE-2016-4912","aliases":["AZL-36966","AZL-7319","EUVD-2016-5887","GHSA-m4qh-6ff4-g5xx","MGASA-2016-0222","SUSE-SU-2016:2661-1","SUSE-SU-2018:0100-1","openSUSE-SU-2024:10065-1"],"status":"published","title":"The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a...","description":"The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0536,"percentile":0.92696,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2016-06-10T19:06:07Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Mageia:5","package":"openslp","fixed_in":["2.0.0-5.1.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.0-26"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.0-26"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-5.1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-18.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-18.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-18.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-18.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-18.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-8.1"}]}],"bundled":3}],"products":[{"vendor":"openslp","product":"openslp"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1329295","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","VDB Entry"]},{"url":"https://security.gentoo.org/glsa/201707-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://www.securitytracker.com/id/1035916","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/18/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4912","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m4qh-6ff4-g5xx"},{"url":"https://advisories.mageia.org/MGASA-2016-0222.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18600","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FGW44JV455TRJ2NZQTEP76JKMFFO2JGS/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162661-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001600","tags":["report"]},{"url":"https://bugzilla.suse.com/974655","tags":["report"]},{"url":"https://bugzilla.suse.com/980722","tags":["report"]},{"url":"https://bugzilla.suse.com/994989","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7567","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180100-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3609","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4912","description":"The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.","status":"published","published":"2017-03-27T17:00:00Z","modified":"2024-08-06T00:46:39.377Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2016-5887","description":"The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.","status":"published","published":"2017-03-27T17:00:00Z","modified":"2024-08-06T00:46:39Z","updated_at":"2026-11-03T02:22:44.489595Z"}],"ghsa":[{"id":"GHSA-m4qh-6ff4-g5xx","title":"The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a...","description":"The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.","status":"published","published":"2022-05-17T02:33:13Z","modified":"2023-01-27T05:05:34Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:42:43.440689Z"}],"nvd":[{"id":"CVE-2016-4912","description":"The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.","status":"published","published":"2017-03-27T17:59:00.43Z","modified":"2026-06-17T00:48:26.44Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"AZL-36966","title":"CVE-2016-4912 affecting package openslp 2.0.0-26","description":"The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.","status":"published","published":"2017-03-27T17:59:00Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-7319","title":"CVE-2016-4912 affecting package openslp 2.0.0-26","description":"The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.","status":"published","published":"2017-03-27T17:59:00Z","modified":"2026-04-21T04:33:50.585193Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"MGASA-2016-0222","title":"Updated openslp packages fix security vulnerability","description":"A null pointer dereference vulnerability was found in function _xrealloc()\nin xlsp_xmalloc.c in OpenSLP. A remote attacker could potentially crash\nthe server when large number of packets are sent (CVE-2016-4912).\n","status":"published","published":"2016-06-10T19:06:07Z","modified":"2026-04-16T06:25:39.302972902Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10065-1","title":"openslp-2.0.0-8.1 on GA media","description":"These are all security issues fixed in the openslp-2.0.0-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:22:27.872486Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2661-1","title":"Security update for openslp","description":"This update for openslp fixes two security issues and two bugs.\n\nThe following vulnerabilities were fixed:\n- CVE-2016-4912: A remote attacker could have crashed the server with a large number of packages (bsc#980722)\n- CVE-2016-7567: A remote attacker could cause a memory corruption having unspecified impact (bsc#1001600)\n\nThe following bugfix changes are included:\n- bsc#994989: Removed convenience code as changes bytes in the message buffer breaking the verification code\n- bsc#974655: Removed no longer needed slpd init file\n","status":"published","published":"2016-10-27T11:06:53Z","modified":"2026-02-04T04:19:48.955678Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2018:0100-1","title":"Security update for openslp","description":"This update for openslp fixes two security issues and two bugs.\n\nThe following vulnerabilities were fixed:\n\n- CVE-2016-4912: A remote attacker could have crashed the server with a large\n  number of packages (bsc#980722)\n- CVE-2016-7567: A remote attacker could cause a memory corruption having\n  unspecified impact (bsc#1001600)\n\nThe following bugfix changes are included:\n\n- bsc#994989: Removed convenience code as changes bytes in the message buffer\n  breaking the verification code\n- bsc#974655: Removed no longer needed slpd init file\n","status":"published","published":"2018-01-15T10:30:50Z","modified":"2026-02-04T04:20:59.882797Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}