Lucene search

MitreCVE-2013-4788

HistoryOct 04, 2013 - 5:55 p.m.

CVE-2013-4788

2013-10-0417:55:09

CWE-20

mitre

web.nvd.nist.gov

cve-2013-4788

gnu c library

glibc

libc6

eglibc

buffer-overflow

vulnerability

pointer guard

execution flow

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

High

EPSS

0.016

Percentile

87.4%

JSON

The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.

Affected configurations

Nvd

Node

gnuglibcRange≤2.17

gnuglibcMatch2.0

gnuglibcMatch2.0.1

gnuglibcMatch2.0.2

gnuglibcMatch2.0.3

gnuglibcMatch2.0.4

gnuglibcMatch2.0.5

gnuglibcMatch2.0.6

gnuglibcMatch2.1

gnuglibcMatch2.1.1

gnuglibcMatch2.1.1.6

gnuglibcMatch2.1.2

gnuglibcMatch2.1.3

gnuglibcMatch2.1.9

gnuglibcMatch2.4

gnuglibcMatch2.10.1

gnuglibcMatch2.11

gnuglibcMatch2.11.1

gnuglibcMatch2.11.2

gnuglibcMatch2.11.3

gnuglibcMatch2.12.1

gnuglibcMatch2.12.2

gnuglibcMatch2.13

gnuglibcMatch2.14

gnuglibcMatch2.14.1

gnuglibcMatch2.15

gnuglibcMatch2.16

Node

gnueglibc

VendorProductVersionCPE
gnuglibc*cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
gnuglibc2.0cpe:2.3:a:gnu:glibc:2.0:*:*:*:*:*:*:*
gnuglibc2.0.1cpe:2.3:a:gnu:glibc:2.0.1:*:*:*:*:*:*:*
gnuglibc2.0.2cpe:2.3:a:gnu:glibc:2.0.2:*:*:*:*:*:*:*
gnuglibc2.0.3cpe:2.3:a:gnu:glibc:2.0.3:*:*:*:*:*:*:*
gnuglibc2.0.4cpe:2.3:a:gnu:glibc:2.0.4:*:*:*:*:*:*:*
gnuglibc2.0.5cpe:2.3:a:gnu:glibc:2.0.5:*:*:*:*:*:*:*
gnuglibc2.0.6cpe:2.3:a:gnu:glibc:2.0.6:*:*:*:*:*:*:*
gnuglibc2.1cpe:2.3:a:gnu:glibc:2.1:*:*:*:*:*:*:*
gnuglibc2.1.1cpe:2.3:a:gnu:glibc:2.1.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gnu	glibc	*	cpe:2.3:a:gnu:glibc::::::::
gnu	glibc	2.0	cpe:2.3:a:gnu:glibc:2.0:::::::*
gnu	glibc	2.0.1	cpe:2.3:a:gnu:glibc:2.0.1:::::::*
gnu	glibc	2.0.2	cpe:2.3:a:gnu:glibc:2.0.2:::::::*
gnu	glibc	2.0.3	cpe:2.3:a:gnu:glibc:2.0.3:::::::*
gnu	glibc	2.0.4	cpe:2.3:a:gnu:glibc:2.0.4:::::::*
gnu	glibc	2.0.5	cpe:2.3:a:gnu:glibc:2.0.5:::::::*
gnu	glibc	2.0.6	cpe:2.3:a:gnu:glibc:2.0.6:::::::*
gnu	glibc	2.1	cpe:2.3:a:gnu:glibc:2.1:::::::*
gnu	glibc	2.1.1	cpe:2.3:a:gnu:glibc:2.1.1:::::::*