Read the docs
TI-2016-07123 Aliases CVE-2016-8661GHSA-pj5v-hc9m-mp8j

Memory corruption in Little Snitch version 3.0 through 3.6.1

Priority LOW 37CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges (EoP) and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to the "OSMalloc" and "copyin" kernel API calls.

Why it matters now

EPSS 0.00417 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Little Snitch version 3.0 through 3.6.1Little Snitch version 3.0 through 3.6.1—No fix listedCNA
  • Little Snitch version 3.0 through 3.6.1 Vendor— Affected Little Snitch version 3.0 through 3.6.1 Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:obdev:little_snitch:3.0:*:*:*:*:*:*:*3.0VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.1:*:*:*:*:*:*:*3.1VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.3:*:*:*:*:*:*:*3.3VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.3.1:*:*:*:*:*:*:*3.3.1VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.3.2:*:*:*:*:*:*:*3.3.2VulnerableObdev
  • cpe:2.3:a:obdev:little_snitch:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·Obdev
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:obdev:little_snitch:3.3.3:*:*:*:*:*:*:*3.3.3VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.3.4:*:*:*:*:*:*:*3.3.4VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.4:*:*:*:*:*:*:*3.4VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.4.1:*:*:*:*:*:*:*3.4.1VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.4.2:*:*:*:*:*:*:*3.4.2VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.5:*:*:*:*:*:*:*3.5VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.5.1:*:*:*:*:*:*:*3.5.1VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.5.2:*:*:*:*:*:*:*3.5.2VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.5.3:*:*:*:*:*:*:*3.5.3VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.6:*:*:*:*:*:*:*3.6VulnerableObdev
cpe:2.3:a:obdev:little_snitch:3.6.1:*:*:*:*:*:*:*3.6.1VulnerableObdev
  • cpe:2.3:a:obdev:little_snitch:3.3.3:*:*:*:*:*:*:* Versions 3.3.3 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.3.4:*:*:*:*:*:*:* Versions 3.3.4 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.4.1:*:*:*:*:*:*:* Versions 3.4.1 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.4.2:*:*:*:*:*:*:* Versions 3.4.2 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.5.2:*:*:*:*:*:*:* Versions 3.5.2 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.5.3:*:*:*:*:*:*:* Versions 3.5.3 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.6:*:*:*:*:*:*:* Versions 3.6 Vulnerable ·Obdev
  • cpe:2.3:a:obdev:little_snitch:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·Obdev

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-8661
  2. 2026-10-03 Alias added: GHSA-pj5v-hc9m-mp8j

References

Other 1

  • TI-2020-10300 Link following in Little Snitch CVSS 3.1HIGH 8.8
  • TI-2017-01921 Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation… CVSS 3.0HIGH 7.8
  • TI-2019-09752 Access control flaw in Little Snitch CVSS 3.1MEDIUM 5.5
  • TI-2019-09751 Access control flaw in Little Snitch CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences