CVE-2016-9639

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.

• CWE-284

• http://www.openwall.com/lists/oss-security/2016/11/25/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/11/25/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94553Third Party Advisory, VDB Entry
• https://docs.saltstack.com/en/2015.8/ref/configuration/master.html#rotate-aes-keyVendor Advisory
• http://www.openwall.com/lists/oss-security/2016/11/25/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/11/25/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94553Third Party Advisory, VDB Entry
• https://docs.saltstack.com/en/2015.8/ref/configuration/master.html#rotate-aes-keyVendor Advisory

Published

Feb 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9633An issue was discovered in the Tatsuya Kinoshita w3m fork be…
• CVE-2016-9634Heap-based buffer overflow in the flx_decode_delta_fli funct…
• CVE-2016-9635Heap-based buffer overflow in the flx_decode_delta_fli funct…
• CVE-2016-9636Heap-based buffer overflow in the flx_decode_delta_fli funct…
• CVE-2016-9637The (1) ioport_read and (2) ioport_write functions in Xen, w…
• CVE-2016-9638In BMC Patrol before 9.13.10.02, the binary "listguests64" i…
• CVE-2016-9642JavaScriptCore in WebKit allows attackers to cause a denial …
• CVE-2016-9643The regex code in Webkit 2.4.11 allows remote attackers to c…
• CVE-2016-9644The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.…
• CVE-2016-9645The fix for ikiwiki for CVE-2016-10026 was incomplete result…
• CVE-2016-9646ikiwiki before 3.20161229 incorrectly called the CGI::FormBu…
• CVE-2016-9647Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…