CVE-2012-4424
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:P/I:P/A:P
AI Score
Confidence
High
EPSS
Percentile
87.3%
Stack-based buffer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string that triggers a malloc failure and use of the alloca function.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| gnu | glibc | * | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* |
| gnu | glibc | 2.0 | cpe:2.3:a:gnu:glibc:2.0:*:*:*:*:*:*:* |
| gnu | glibc | 2.0.1 | cpe:2.3:a:gnu:glibc:2.0.1:*:*:*:*:*:*:* |
| gnu | glibc | 2.0.2 | cpe:2.3:a:gnu:glibc:2.0.2:*:*:*:*:*:*:* |
| gnu | glibc | 2.0.3 | cpe:2.3:a:gnu:glibc:2.0.3:*:*:*:*:*:*:* |
| gnu | glibc | 2.0.4 | cpe:2.3:a:gnu:glibc:2.0.4:*:*:*:*:*:*:* |
| gnu | glibc | 2.0.5 | cpe:2.3:a:gnu:glibc:2.0.5:*:*:*:*:*:*:* |
| gnu | glibc | 2.0.6 | cpe:2.3:a:gnu:glibc:2.0.6:*:*:*:*:*:*:* |
| gnu | glibc | 2.1 | cpe:2.3:a:gnu:glibc:2.1:*:*:*:*:*:*:* |
| gnu | glibc | 2.1.1 | cpe:2.3:a:gnu:glibc:2.1.1:*:*:*:*:*:*:* |
References
sourceware.org/bugzilla/show_bug.cgi?id=14547
www.mandriva.com/security/advisories?name=MDVSA-2013:283
www.mandriva.com/security/advisories?name=MDVSA-2013:284
www.openwall.com/lists/oss-security/2012/09/13/16
www.ubuntu.com/usn/USN-1991-1
bugzilla.redhat.com/show_bug.cgi?id=858238
security.gentoo.org/glsa/201503-04
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:P/I:P/A:P
AI Score
Confidence
High
EPSS
Percentile
87.3%