Skip to content
Fencer Intel
high 7.5

CVE-2016-6855 in the critical feed json

Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow rem…

published 2016-09-07 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-7740

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
18.4%
EPSS 18.4% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.

Patch / fix

  • eog Debian 14, Debian 13, Debian 12 3.20.4-1

debian advisories DEBIAN-CVE-2016-6855

  • eog Ubuntu 14.04 LTS 3.10.2-0ubuntu5.2
  • eog Ubuntu 16.04 LTS 3.18.2-1ubuntu2.1

ubuntu advisories UBUNTU-CVE-2016-6855

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eog SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 3.10.2-2.3.1

suse advisories SUSE-SU-2016:2827-1

  • eog openSUSE Tumbleweed 3.20.5-1.1

opensuse advisories openSUSE-SU-2024:10170-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-6855 updated cvss 3.3

eog: Out-of-bounds write when passing invalid UTF-8 to GMarkup

  • Red Hat Enterprise Linux 7 eog
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 5 eog Red Hat Enterprise Linux 6 eog
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-40291)
  2. Published

Exploit prediction

18.38% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-40291 Eye of Gnome 3.10.2 - GMarkup Out of Bounds Write dos, 2016-08-23
  • packetstormsecurity.com http://packetstormsecurity.com/files/138486/Gnome-Eye-Of-Gnome-3.10.2-Out-Of-Bounds-Write.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.