glibc: fnmatch() alloca()-based memory corruption flaw

🗓️ 04 Apr 2011 20:01:00Reported by RedHatType

glibc fnmatch memory corruption and integer overflow allow denial of service via a long UTF-8 string in a crafted pattern up to version 2.13.

Reporter	Title	Published	Views	Family All 120
IBM Security Bulletins	Security Bulletin: z/TPF is affected by GNU C library (glibc) vulnerabilities	1 Mar 201918:05	–	ibm
ATTACKERKB	CVE-2011-1659	8 Apr 201115:17	–	attackerkb
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the CentOS operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	5	i386	glibc	0:2.5-58.el5_6.2	glibc-0:2.5-58.el5_6.2.i386.rpm
Red Hat Enterprise Linux	5	i686	glibc	0:2.5-58.el5_6.2	glibc-0:2.5-58.el5_6.2.i686.rpm
Red Hat Enterprise Linux	5	ia64	glibc	0:2.5-58.el5_6.2	glibc-0:2.5-58.el5_6.2.ia64.rpm
Red Hat Enterprise Linux	5	ppc	glibc	0:2.5-58.el5_6.2	glibc-0:2.5-58.el5_6.2.ppc.rpm
Red Hat Enterprise Linux	5	ppc64	glibc	0:2.5-58.el5_6.2	glibc-0:2.5-58.el5_6.2.ppc64.rpm
Red Hat Enterprise Linux	5	s390	glibc	0:2.5-58.el5_6.2	glibc-0:2.5-58.el5_6.2.s390.rpm
Red Hat Enterprise Linux	5	s390x	glibc	0:2.5-58.el5_6.2	glibc-0:2.5-58.el5_6.2.s390x.rpm
Red Hat Enterprise Linux	5	x86_64	glibc	0:2.5-58.el5_6.2	glibc-0:2.5-58.el5_6.2.x86_64.rpm
Red Hat Enterprise Linux	5	i386	glibc-common	0:2.5-58.el5_6.2	glibc-common-0:2.5-58.el5_6.2.i386.rpm
Red Hat Enterprise Linux	5	ia64	glibc-common	0:2.5-58.el5_6.2	glibc-common-0:2.5-58.el5_6.2.ia64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2011-1659
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2011-1659
cve	www.cve.org/CVERecord

28 Jan 2026 22:51Current

6.2Medium risk

Vulners AI Score6.2

CVSS 25.1

EPSS0.14323