Reporter Cloud Foundry
CVE-2014-5119 glib_gconv_translit_find() exploit
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Certain applications could be made to crash or run programs as an administrator.
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.
Affected Products and Versions
Severity is important unless otherwise noted.
- Cloud Foundry Runtime Deployments prior to v183 with BOSH Ubuntu stemcells prior to 2710
Users of affected versions should apply the following mitigation:
- The Cloud Foundry Project recommends that Cloud Foundry Runtime Deployments running Release v182 or earlier upgrade to v183 or later and BOSH Ubuntu stemcell 2710 or later, which resolves this vulnerability.
This issue was discovered by Tavis Ormandy and John Haxby.
2014-Sep-19: Initial vulnerability report published.