Several vulnerabilities were discovered in GNU Guile, an implementation of the Scheme programming language. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2016-8605: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions.

CVE-2016-8606: GNU Guile provides a 'REPL server' which is a command prompt that developers can connect to for live coding and debugging purposes. The REPL server is started by the '--listen' command-line option or equivalent API.

It was reported that the REPL server is vulnerable to the HTTP inter-protocol attack.

This constitutes a remote code execution vulnerability for developers running a REPL server that listens on a loopback device or private network. Applications that do not run a REPL server, as is usually the case, are unaffected.

For Debian 7 'Wheezy', these problems have been fixed in version 2.0.5+1-3+deb7u1.

We recommend that you upgrade your guile-2.0 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for guile fixes the following issues :

  - CVE-2016-8606: REPL server vulnerable to HTTP     inter-protocol attacks (bsc#1004226).

  - CVE-2016-8605: Thread-unsafe umask modification     (bsc#1004221).

An update of the guile package has been released.

Update to the latest stable release, which fixes CVE-2016-8605 and CVE-2016-8606.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of [guile,ntp] packages for PhotonOS has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP     inter-protocol attack. (CVE-2016-8606)

Note that Nessus relies on the presence of the package as reported by the vendor.

Ludovic Courtes reports :

The REPL server is vulnerable to the HTTP inter-protocol attack

The 'mkdir' procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions.

ID	Name	Product	Family	Published	Updated	Severity
94114	Debian DLA-666-1 : guile-2.0 security update	Nessus	Debian Local Security Checks	10/19/2016	1/11/2021	critical
94310	openSUSE Security Update : guile (openSUSE-2016-1235)	Nessus	SuSE Local Security Checks	10/27/2016	1/19/2021	critical
121667	Photon OS 1.0: Guile PHSA-2017-0003	Nessus	PhotonOS Local Security Checks	2/7/2019	7/23/2024	critical
94210	Fedora 23 : 5:guile (2016-a47bf58beb)	Nessus	Fedora Local Security Checks	10/24/2016	1/11/2021	critical
94771	Fedora 25 : 5:guile (2016-0aab71f552)	Nessus	Fedora Local Security Checks	11/15/2016	1/11/2021	critical
111852	Photon OS 1.0: Guile / Ntp / Ntpstat PHSA-2017-0003 (deprecated)	Nessus	PhotonOS Local Security Checks	8/17/2018	4/5/2019	critical
219905	Linux Distros Unpatched Vulnerability : CVE-2016-8606	Nessus	Misc.	3/4/2025	3/4/2025	critical
96994	FreeBSD : guile2 -- multiple vulnerabilities (b4ecf774-eb01-11e6-9ac1-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	2/6/2017	1/4/2021	critical
94120	Fedora 24 : 5:guile (2016-34209c3a8e)	Nessus	Fedora Local Security Checks	10/19/2016	1/11/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical