Buffer Length Calculation Flaw in GNU C Library Affects Multiple Versions
CVE-2012-3405

Currently unrated

Key Information:

Vendor
Canonical
Status
Ubuntu Linux
Enterprise Linux
Glibc
Enterprise Virtualization
Vendor
CVE Published:
10 February 2014

Summary

A flaw exists in the vfprintf function within the GNU C Library, specifically affecting version 2.14 and earlier. This vulnerability arises from improper calculation of buffer lengths, enabling context-dependent attackers to exploit the issue. By utilizing a format string with numerous specifiers, attackers may trigger ‘desynchronization’ in buffer size handling, leading to potential denial-of-service scenarios, including application crashes. This flaw poses significant risks to systems relying on glibc for formatted input/output operations.

References

http://rhn.redhat.com/errata/RHSA-2012-1200.html
vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=833704
x_refsource_CONFIRM
https://sourceware.org/bugzilla/show_bug.cgi?id=13446
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.