CVE-2016-4359

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow in mchan.dll in the agent in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 allows remote attackers to execute arbitrary code via a long -server_name value, aka ZDI-CAN-3516.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/90975
http://www.securitytracker.com/id/1036006Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-363Third Party Advisory, VDB Entry
https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05157423Vendor Advisory
https://www.tenable.com/security/research/tra-2016-16
http://www.securityfocus.com/bid/90975
http://www.securitytracker.com/id/1036006Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-363Third Party Advisory, VDB Entry
https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05157423Vendor Advisory
https://www.tenable.com/security/research/tra-2016-16

Timeline

Published: Jun 8, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-43609.1web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patc CVE-2016-43617.5HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Per CVE-2016-43628.1HPE Insight Control server deployment allows remote authenticated users to obtain sensitive information or modify data via unspecified vecto CVE-2016-43636.1HPE Insight Control server deployment allows remote attackers to modify data via unspecified vectors.CVE-2016-43648.4HPE Insight Control server deployment allows local users to gain privileges via unspecified vectors.CVE-2016-43657.5HPE Insight Control server deployment allows remote attackers to obtain sensitive information via unspecified vectors.CVE-2016-43669.8HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of se CVE-2016-43677.5The Universal Discovery component in HPE Universal CMDB 10.0, 10.01, 10.10, 10.11, 10.20, and 10.21 allows remote attackers to obtain sensit CVE-2016-43689.8HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 a CVE-2016-43698.8HPE Discovery and Dependency Mapping Inventory (DDMi) 9.30, 9.31, 9.32, 9.32 update 1, 9.32 update 2, and 9.32 update 3 allows remote authen CVE-2016-43708.8HPE Project and Portfolio Management Center (PPM) 9.2x and 9.3x before 9.32.0002 allows remote authenticated users to execute arbitrary comm CVE-2016-43718.0HPE Service Manager Software 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote authenticated users to obtain sensitive inform