CVE catalog

CVE-2016-9956

flightgear: CVE-2016-9956

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
3.24% · Oct 25, 2026

The route manager in FlightGear before 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianflightgearsid1:2024.1.5+dfsg-1fixed
Debianflightgeartrixie1:2020.3.19+dfsg-1fixed
Debianflightgearbookworm1:2020.3.16+dfsg-1+deb12u1fixed
Ubuntuflightgear16.043.4.0-1build1vulnerable
Ubuntuflightgear16.043.4.0-2vulnerable
Ubuntuflightgear16.043.4.0-3vulnerable
Ubuntuflightgear16.043.4.0-3ubuntu1vulnerable
Ubuntuflightgear16.043.4.0-3ubuntu1.1fixed
Ubuntuflightgear16.043.4.0-1build1vulnerable
Ubuntuflightgear16.043.4.0-2vulnerable
Ubuntuflightgear16.043.4.0-3vulnerable
Ubuntuflightgear16.043.4.0-3ubuntu1vulnerable
Ubuntuflightgear16.043.4.0-3ubuntu1.1fixed
OpensuseFlightGeartumbleweed2020.3.11-1.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianflightgearsourcesid1:2016.4.3+dfsg-1not yet assignedNot reported[848114]
Debianflightgearsourcetrixie1:2016.4.3+dfsg-1not yet assignedNot reported[848114]
Debianflightgearsourcebookworm1:2016.4.3+dfsg-1not yet assignedNot reported[848114]
Ubuntuflightgeardeb16.043.4.0-3ubuntu1.1Not reportedUSN-4588-1Not reported
Ubuntuflightgeardeb16.043.4.0-3ubuntu1.1Not reportedUBUNTU-CVE-2016-9956Not reported
OpensuseFlightGearrpmtumbleweed2020.3.11-1.3Not reportedOPENSUSE-SU-2024:10595-1Not reported

[Debian bug #848114]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [flightgear]Fixed
    Details (2)

    • 1:2020.3.16+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1:2016.4.3+dfsg-1

      dsa · flightgear · debian · bookworm

    • 1:2020.3.16+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1:2016.4.3+dfsg-1

      dsa · flightgear · debian · bookworm

[openSUSE Tumbleweed]

  • [FlightGear]Fixed

    Source package: [FlightGear]

    Details (1)

    • 2024.1.6-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 2020.3.11-1.3

      dsa · FlightGear · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]