CVE-2012-4424

2013-10-0922:55:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2012-4424

buffer overflow

glibc

denial of service

arbitrary code execution

nvd

7.8 High

AI Score

Confidence

High

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.016 Low

EPSS

Percentile

87.0%

JSON

Stack-based buffer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string that triggers a malloc failure and use of the alloca function.

CPENameOperatorVersion
gnu:glibcgnu glibceq2.1.2
gnu:glibcgnu glibceq2.11
gnu:glibcgnu glibceq2.0.5
gnu:glibcgnu glibceq2.0.6
gnu:glibcgnu glibceq2.10.1
gnu:glibcgnu glibceq2.1.1
gnu:glibcgnu glibceq2.14
gnu:glibcgnu glibceq2.0.3
gnu:glibcgnu glibceq2.0
gnu:glibcgnu glibceq2.13

CPE	Name	Operator	Version
gnu:glibc	gnu glibc	eq	2.1.2
gnu:glibc	gnu glibc	eq	2.11
gnu:glibc	gnu glibc	eq	2.0.5
gnu:glibc	gnu glibc	eq	2.0.6
gnu:glibc	gnu glibc	eq	2.10.1
gnu:glibc	gnu glibc	eq	2.1.1
gnu:glibc	gnu glibc	eq	2.14
gnu:glibc	gnu glibc	eq	2.0.3
gnu:glibc	gnu glibc	eq	2.0
gnu:glibc	gnu glibc	eq	2.13