CVE-2016-6385

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Memory leak in the Smart Install client implementation in Cisco IOS 12.2 and 15.0 through 15.2 and IOS XE 3.2 through 3.8 allows remote attackers to cause a denial of service (memory consumption) via crafted image-list parameters, aka Bug ID CSCuy82367.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-399

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-smiMitigation, Vendor Advisory
http://www.securityfocus.com/bid/93203Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036914
https://ics-cert.us-cert.gov/advisories/ICSA-16-287-04Third Party Advisory, US Government Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-smiMitigation, Vendor Advisory
http://www.securityfocus.com/bid/93203Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036914
https://ics-cert.us-cert.gov/advisories/ICSA-16-287-04Third Party Advisory, US Government Resource

Timeline

Published: Oct 5, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-63867.5Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service (data-structure corruption a CVE-2016-63917.5Cisco IOS 12.2 and 15.0 through 15.3 allows remote attackers to cause a denial of service (traffic-processing outage) via a crafted series o CVE-2016-63927.5Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.1 through 3.9 allow remote attackers to cause a denial of service (device restart) via a c CVE-2016-63937.5The AAA service in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.1 through 3.18 and 16.2 allows remote attackers to cause a CVE-2016-63949.1Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attacker CVE-2016-63955.4Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT CVE-2016-63965.3Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1, when certain malware blocking options are enabled, al CVE-2016-63979.8A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System (IPICS) Universal Medi CVE-2016-63985.3The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive informa CVE-2016-63997.5Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote CVE-2016-64015.3Cisco Carrier Routing System (CRS) 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers CVE-2016-64027.8UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root ac