CVE-2016-10728

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/kirillwow/ids_bypassExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00019.htmlThird Party Advisory
https://redmine.openinfosecfoundation.org/issues/1880Third Party Advisory
https://suricata-ids.org/2016/09/07/suricata-3-1-2-released/Vendor Advisory
https://github.com/kirillwow/ids_bypassExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00019.htmlThird Party Advisory
https://redmine.openinfosecfoundation.org/issues/1880Third Party Advisory
https://suricata-ids.org/2016/09/07/suricata-3-1-2-released/Vendor Advisory

Timeline

Published: Jul 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-107297.8An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid r CVE-2016-10739.8Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Contin CVE-2016-107307.8An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. Amstar is an Amanda A CVE-2016-107319.8ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the requ CVE-2016-107329.8ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or proc CVE-2016-107339.8ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.CVE-2016-107349.8ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.CVE-2016-107356.1In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2016-107366.1The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_CVE-2016-107375.4Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.CVE-2016-107388.8Zenbership v107 has CSRF via admin/cp-functions/event-add.php.CVE-2016-107395.3In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 ad