CVE-2016-4429

glibc: libtirpc: stack (frame) overflow in Sun RPC clntudp_call()

Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.

CVSS 3.1 · 5.9 Medium EPSS 4.6% KEV · Not listed

Vendors

Canonical Gnu Opensuse

Products

Ubuntu Linux Glibc Leap and 1 more

CVE-2016-6323

glibc: Missing unwind info in __startcontext causes infinite loop in _Unwind_Backtrace

The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.

CVSS 3.0 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Fedoraproject Gnu Opensuse

Products

Fedora Glibc Opensuse

CVE-2011-1071

glibc: fnmatch() alloca()-based memory corruption flaw

The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.

CVSS 2.0 · 5.1 Medium EPSS 14.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Eglibc Glibc Enterprise Linux

CVE-2009-4880

(32-bit): Multiple integer overflows in the printf implementation

Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391.

CVSS 2.0 · 5.0 Medium EPSS 11.2% KEV · Not listed

Vendors

Gnu

Products

Glibc

CVE-2009-4881

(32-bit): Integer overflow in the __vstrfmon_l function

Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed

Vendors

Gnu

Products

Glibc

CVE-2009-5029

glibc: __tzfile_read integer overflow to buffer overflow

Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.

CVSS 2.0 · 6.8 Medium EPSS 8.8% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2009-5064

glibc: ldd unexpected code execution issue

ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2010-0296

glibc: Improper encoding of names with certain special character in utilities for writing to mtab table

The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2010-0830

glibc: ld.so d_tag signedness error in elf_get_dynamic_info

Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows user-assisted remote attackers to execute arbitrary code via a crafted ELF program with a negative value for a certain d_tag structure member in the ELF header.

CVSS 2.0 · 5.1 Medium EPSS 4.5% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2010-3192

glibc: __fortify_fail may use corrupted memory when called from SSP callback

Certain run-time memory protection mechanisms in the GNU C Library (aka glibc or libc6) print argv[0] and backtrace information, which might allow context-dependent attackers to obtain sensitive information from process memory by executing an incorrect program, as demonstrated by a setuid program that contains a stack-based buffer overflow error, related to the __fortify_fail function in debug/fortify_fail.c, and the __stack_chk_fail (aka stack protection) and __chk_fail (aka FORTIFY_SOURCE) implementations.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed

Vendors

Gnu

Products

Glibc

CVE-2010-3847

glibc: ld.so insecure handling of $ORIGIN in LD_AUDIT for setuid/setgid programs

elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory.

CVSS 2.0 · 6.9 Medium EPSS 10.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2010-3856

glibc: ld.so arbitrary DSO loading via LD_AUDIT in setuid/setgid programs

ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so.

CVSS 2.0 · 7.2 High EPSS 12.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2011-1089

glibc: Suid mount helpers fail to anticipate RLIMIT_FSIZE

The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a process with a small RLIMIT_FSIZE value, a different vulnerability than CVE-2010-0296.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2011-0536

glibc: fix causes linker to search CWD when running privileged program with $ORIGIN in R*PATH

Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and glibc-2.12-1.7.el6_0.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted dynamic shared object (DSO) in a subdirectory of the current working directory during execution of a (1) setuid or (2) setgid program that has $ORIGIN in (a) RPATH or (b) RUNPATH within the program itself or a referenced library. NOTE: this issue exists because of an incorrect fix for CVE-2010-3847.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2010-4051

glibc: De-recursivise regular expression engine

The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow."

CVSS 2.0 · 5.0 Medium EPSS 40.0% KEV · Not listed

Vendors

Gnu

Products

Glibc

CVE-2013-4788

glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables

The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.

CVSS 2.0 · 5.1 Medium EPSS 11.4% KEV · Not listed

Vendors

Gnu

Products

Eglibc Glibc

CVE-2013-4458

glibc: Stack (frame) overflow in getaddrinfo() when called with AF_INET6

Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.

CVSS 2.0 · 5.0 Medium EPSS 4.2% KEV · Not listed

Vendors

Gnu Redhat Suse

Products

Glibc Enterprise Linux Linux Enterprise Debuginfo and 1 more

CVE-2010-4052

glibc: De-recursivise regular expression engine

Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.

CVSS 2.0 · 5.0 Medium EPSS 51.3% KEV · Not listed

Vendors

Gnu

Products

Glibc

CVE-2013-4332

glibc: three integer overflows in memory allocator

Multiple integer overflows in malloc/malloc.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allow context-dependent attackers to cause a denial of service (heap corruption) via a large value to the (1) pvalloc, (2) valloc, (3) posix_memalign, (4) memalign, or (5) aligned_alloc functions.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2013-4237

glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX characters

sysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted (1) NTFS or (2) CIFS image.

CVSS 2.0 · 6.8 Medium EPSS 3.8% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux