{"id":"CVE-2017-9951","aliases":["ALPINE-CVE-2017-9951","DEBIAN-CVE-2017-9951","DLA-1033-1","DSA-4218-1","EUVD-2017-18861","GHSA-vpcm-5gwm-79h2","MGASA-2017-0441","SUSE-SU-2018:0778-1","SUSE-SU-2018:0807-1","SUSE-SU-2018:0839-1","SUSE-SU-2018:1601-1","UBUNTU-CVE-2017-9951","USN-3588-1","openSUSE-SU-2024:11045-1"],"status":"published","title":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers...","description":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04166,"percentile":0.90949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-07-17T00:00:00Z","modified":"2026-10-24T10:30:29Z","fixes":[{"ecosystem":"Alpine:v3.3","package":"memcached","fixed_in":["1.4.33-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"memcached","fixed_in":["1.4.33-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"memcached","fixed_in":["1.4.33-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"memcached","fixed_in":["1.4.36-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"memcached","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"memcached","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"memcached","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"memcached","fixed_in":["1.4.13-0.2+deb7u3"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"memcached","fixed_in":["1.4.39-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"memcached","fixed_in":["1.4.39-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"memcached","fixed_in":["1.4.39-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"memcached","fixed_in":["1.4.39-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"memcached","fixed_in":["1.4.39-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"memcached","fixed_in":["1.4.39-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"memcached","fixed_in":["1.4.39-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"memcached","fixed_in":["1.4.39-4.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"memcached","fixed_in":["1.4.14-0ubuntu9.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"memcached","fixed_in":["1.4.25-2ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.3","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.36-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-0.2+deb7u3"}]}],"versions":["1.4.13-0.2","1.4.13-0.2+deb7u1","1.4.13-0.2+deb7u2"]},{"source":"osv","ecosystem":"Debian:8","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-1.1+deb8u2"}]}],"versions":["1.4.21-1.1","1.4.21-1.1+deb8u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-1+deb9u1"}]}],"versions":["1.4.33-1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:5","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-3.3.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-3.3.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-3.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-5.17.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-5.17.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Studio Onsite Runner 1.3","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-5.17.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-0ubuntu9.2"}]}],"versions":["1.4.14-0ubuntu4","1.4.14-0ubuntu8","1.4.14-0ubuntu9","1.4.14-0ubuntu9.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.25-2ubuntu1.3"}]}],"versions":["1.4.24-2ubuntu1","1.4.25-1ubuntu2","1.4.25-2ubuntu1","1.4.25-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-0ubuntu9.2"}]}],"versions":["1.4.14-0ubuntu4","1.4.14-0ubuntu8","1.4.14-0ubuntu9","1.4.14-0ubuntu9.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.25-2ubuntu1.3"}]}],"versions":["1.4.24-2ubuntu1","1.4.25-1ubuntu2","1.4.25-2ubuntu1","1.4.25-2ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-2.3"}]}],"bundled":4}],"products":[{"vendor":"memcached","product":"memcached"}],"references":[{"url":"https://usn.ubuntu.com/3588-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://github.com/memcached/memcached/wiki/ReleaseNotes1439","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/99874","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.debian.org/security/2018/dsa-4218","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","report"]},{"url":"https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9951"},{"url":"https://usn.ubuntu.com/3588-1"},{"url":"https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report"},{"url":"https://github.com/advisories/GHSA-vpcm-5gwm-79h2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-9951","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9951","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0441.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22068","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EGQ5CRXRSHTKFUB5MCASDOTTZT7YR6IR/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007869","tags":["report"]},{"url":"https://bugzilla.suse.com/1007870","tags":["report"]},{"url":"https://bugzilla.suse.com/1007871","tags":["report"]},{"url":"https://bugzilla.suse.com/1056865","tags":["report"]},{"url":"https://bugzilla.suse.com/798458","tags":["report"]},{"url":"https://bugzilla.suse.com/817781","tags":["report"]},{"url":"https://bugzilla.suse.com/857188","tags":["report"]},{"url":"https://bugzilla.suse.com/858676","tags":["report"]},{"url":"https://bugzilla.suse.com/858677","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9951","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180807-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180839-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181601-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-9951","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3588-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000115","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10931","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-9951","description":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.","status":"published","published":"2017-07-17T06:00:00Z","modified":"2024-08-05T17:24:59.972Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18861","description":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.","status":"published","published":"2017-07-17T06:00:00Z","modified":"2024-08-05T17:24:59Z","updated_at":"2026-11-03T02:23:26.143318Z"}],"ghsa":[{"id":"GHSA-vpcm-5gwm-79h2","title":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers...","description":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.","status":"published","published":"2022-05-13T01:48:14Z","modified":"2025-04-20T03:40:55Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:49.006624Z"}],"nvd":[{"id":"CVE-2017-9951","description":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.","status":"published","published":"2017-07-17T13:18:30.97Z","modified":"2026-06-17T01:29:16.383Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"ALPINE-CVE-2017-9951","description":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.","status":"published","published":"2017-07-17T13:18:30.97Z","modified":"2026-06-15T18:25:26.41834792Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2017-9951","description":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.","status":"published","published":"2017-07-17T13:18:30.97Z","modified":"2026-10-24T10:30:29.792226305Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2017-9951","description":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.","status":"published","published":"2017-07-17T13:18:30.97Z","modified":"2026-09-01T20:02:42.947989411Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9951","description":"The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.","status":"published","published":"2017-07-17T00:00:00Z","modified":"2026-02-04T04:35:46.735403Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1033-1","title":"memcached - security update","status":"published","published":"2017-07-20T00:00:00Z","modified":"2026-03-09T01:01:54.138715Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4218-1","title":"memcached - security update","status":"published","published":"2018-06-06T00:00:00Z","modified":"2026-03-09T01:22:54.032128Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2017-0441","title":"Updated memcached packages fix security vulnerability","description":"The try_read_command function in memcached.c in memcached before 1.4.39\nallows remote attackers to cause a denial of service (segmentation\nfault) via a request to add/set a key, which makes a comparison between\nsigned and unsigned int and triggers a heap-based buffer over-read\n(CVE-2017-9951).\n","status":"published","published":"2017-12-01T23:13:21Z","modified":"2026-04-16T06:25:53.780324404Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11045-1","title":"memcached-1.6.9-2.3 on GA media","description":"These are all security issues fixed in the memcached-1.6.9-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:06.262209Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:0778-1","title":"Security update for memcached","description":"This update for memcached fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2011-4971: remote DoS (bsc#817781).\n- CVE-2013-0179: DoS when printing out keys to be deleted in  verbose mode (bsc#798458).\n- CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).\n- CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).\n- CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).\n- CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).\n- CVE-2016-8705: Server update remote code execution (bsc#1007870).\n- CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).\n- CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).\n","status":"published","published":"2018-03-22T13:15:48Z","modified":"2026-02-04T04:08:13.355547Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0807-1","title":"Security update for memcached","description":"This update for memcached fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2011-4971: remote DoS (bsc#817781).\n- CVE-2013-0179: DoS when printing out keys to be deleted in  verbose mode (bsc#798458).\n- CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).\n- CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).\n- CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).\n- CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).\n- CVE-2016-8705: Server update remote code execution (bsc#1007870).\n- CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).\n- CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).\n","status":"published","published":"2018-03-26T09:47:34Z","modified":"2026-02-04T03:07:58.794706Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0839-1","title":"Security update for memcached","description":"This update for memcached fixes the following issues:\n\n- CVE-2017-9951: Fixed heap-based buffer over-read in try_read_command function which allowed remote attackers to cause a denial of service attack (bsc#1056865).\n","status":"published","published":"2018-03-29T06:31:49Z","modified":"2025-05-02T04:07:10.480435Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1601-1","title":"Security update for memcached","description":"\nThis update fixes the following issues:\n  \n- CVE-2016-8705: Server update remote code execution (bsc#1007870).\n- CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).\n\n","status":"published","published":"2018-06-08T09:38:16Z","modified":"2026-02-04T02:45:44.763457Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-3588-1","title":"memcached vulnerabilities","description":"Daniel Shapira discovered an integer overflow issue in Memcached. A remote\nattacker could use this to cause a denial of service (daemon crash).\n(CVE-2017-9951)\n\nIt was discovered that Memcached listened to UDP by default. A remote\nattacker could use this as part of a distributed denial of service attack.\n(CVE-2018-1000115)\n","status":"published","published":"2018-03-05T15:02:20Z","modified":"2026-02-10T04:41:17Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}