CVE-2016-6082: IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition

Critical severity · published Feb 1, 2017

CVE-2016-6082

IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition

10.0

CVSS

4.7%

EPSS

On KEV

Description

IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the system.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)4.7% · higher than 92% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Bigfix Platform · Ibm

9.0; 9.1; 9.2; 9.5 · source: NVD

Affected product

Bigfix Platform

Ibm

All Bigfix Platform CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-6082

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-6082

Patch

http://www.ibm.com/support/docview.wss?uid=swg21996375

Third Party Advisory

http://www.securityfocus.com/bid/95297