Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Memcached may let attackers run code remotely

CVE-2016-8705 · published 9 years ago
Summary

The Memcached service on Debian can mishandle a series of commands, causing a memory error that lets an attacker insert their own code. This could give an external party control over the server. Apply the latest security update for Memcached as soon as possible.

What to do
  • Update debian memcached to version 1.4.33-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian memcached < 1.4.33-1
Fix: upgrade to 1.4.33-1
Debian:13 debian memcached < 1.4.33-1
Fix: upgrade to 1.4.33-1
Debian:14 debian memcached < 1.4.33-1
Fix: upgrade to 1.4.33-1
– memcached memcached <= 1.4.31
cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*
Original advisory text
Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and ...
Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
References
Severity
9.8 Critical
Exploitation
20% chance of attack within 30 days
Type
CWE-190Integer Overflow
Timeline
Published6 Jan 2017
Updated20 Oct 2026
First seen22 Sep 2026
Sources
DEBIAN-CVE-2016-8705 · OSV
CVE-2016-8705 · NVD
Track software like this
Free during beta