The BSD libc library's link_ntoa() function may be vulnerable to a classic buffer overflow
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
Improper bounds checking of the obuf variable in the link_ntoa() function in linkaddr.c of the BSD libc library may allow an attacker to read or write from memory. The full impact and severity depends on the method of exploit and how the library is used by applications. According to analysis by FreeBSD developers, it is very unlikely that applications exist that utilize link_ntoa() in an exploitable manner, and the CERT/CC is not aware of any proof of concept. A blog post describes the functionality of link_ntoa() and points out that none of the base utilities use this function in an exploitable manner. For more information, please see FreeBSD Security Advisory SA-16:37.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BSD | libc library | link_ntoa() | — | No fix listed | CNA |
- libc library VendorBSD Affected link_ntoa() Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:9.3:*:*:*:*:*:*:* | 9.3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:10.1:*:*:*:*:*:*:* | 10.1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:10.2:*:*:*:*:*:*:* | 10.2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:10.3:*:*:*:*:*:*:* | 10.3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:9.3:*:*:*:*:*:*:* Versions 9.3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·FreeBSD
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-6559
- 2026-10-03 Alias added: GHSA-hxwf-fxc3-j23c
References
Advisory 2
More BSD vulnerabilities
- TI-2008-04392 The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft… CVSS 2.0HIGH 7.1
- TI-2001-00645 Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating… CVSS 2.0HIGH 7.5
- TI-2014-06517 BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address. CVSS 3.1HIGH 7.8
- TI-2003-00139 Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3… CVSS 2.0HIGH 7.2
- TI-2014-06035 The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD… CVSS 2.0MEDIUM 5.0
- TI-2001-01510 Format string vulnerability in nvi before 1.79 allows local users to gain privileges via… CVSS 2.0HIGH 7.2
Sources
- CVE-2016-6559 · CVE Program
- CVE-2016-6559 · NVD
- FIRST EPSS
- GHSA-hxwf-fxc3-j23c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences