CVE-2016-8859 (attacker controlled integer overflow in tre_tnfa_run_parallel())

[lfam]

CVE-2016-8859 was assigned for an integer overflow in musl and, apparently, TRE that can potentially allow an attacker to achieve controlled heap corruption:

http://seclists.org/oss-sec/2016/q4/183

The reporter pointed out the fix applied in musl:

http://git.musl-libc.org/cgit/musl/commit/?id=c3edc06d1e1360f3570db9155d6b318ae0d0f0f7

[achivetta]

I think #37 also covers some of the same issues.

[anarcat]

in #37, only https://bugs.chromium.org/p/project-zero/issues/detail?id=429&can=1&q=TRE&redir=1 is relevant to here, the other two issues are different, undocumented, security issues.