Fortify Software Security Center

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03447895 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03447895 Version: 1 HPSBMU02802...

glibc: incorrect size calculation in formatted printing can lead to FORTIFY_SOURCE format string protection bypass

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library aka glibc 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service stack...

glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library aka glibc 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service segmentati...

glibc: printf() unbound alloca() usage in case of positional parameters + many format specs

The vfprintf function in stdio-common/vfprintf.c in GNU C Library aka glibc 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string...

CVE-2012-3249

HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2012-3248

HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote attackers to obtain sensitive information via unspecified vectors...

Information disclosure

HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote authenticated users to obtain sensitive information via unspecified vectors...

Information disclosure

HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2012-3248

HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2012-3249

HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2012-3248

HP Fortify Software Security Center versions 3.1, 3.3, 3.4 and 3.5 on Windows, Linux, and Solaris are affected by a vulnerability that allows remote, unauthenticated disclosure of information via unspecified vectors. HP’s security bulletin HPSBMU02801 (SSRT100879 rev.1) notes the issue is resolve...

CVE-2012-3249

CVE-2012-3249 affects HP Fortify Software Security Center versions 3.1, 3.3, 3.4, and 3.5. The issue allows remote authenticated users to obtain sensitive information via unspecified vectors. HP’s Security Bulletin notes a privileged information disclosure vulnerability and lists affected platfor...

PT-2012-4596

Name of the Vulnerable Software and Affected Versions HP Fortify Software Security Center versions 3.1, 3.3, 3.4, 3.5 Description The issue allows remote authenticated users to obtain sensitive information. Recommendations For HP Fortify Software Security Center versions 3.1, 3.3, 3.4, 3.5, at th...

CVE-2012-3248: Exposure of Sensitive Information to an Unauthorized Actor

HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2012-3249: Exposure of Sensitive Information to an Unauthorized Actor

HP Fortify Software Security Center 3.1, 3.3, 3.4, and 3.5 allows remote authenticated users to obtain sensitive information via unspecified vectors...

PT-2012-4595

Name of the Vulnerable Software and Affected Versions HP Fortify Software Security Center versions 3.1, 3.3, 3.4, 3.5 Description The issue allows remote attackers to obtain sensitive information via unspecified vectors. Recommendations For HP Fortify Software Security Center versions 3.1, 3.3,...

glibc: printf() unbound alloca() usage in case of positional parameters + many format specs

The vfprintf function in stdio-common/vfprintf.c in GNU C Library aka glibc 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string...

glibc: incorrect size calculation in formatted printing can lead to FORTIFY_SOURCE format string protection bypass

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library aka glibc 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service stack...

glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library aka glibc 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service segmentati...

glibc: printf() unbound alloca() usage in case of positional parameters + many format specs

The vfprintf function in stdio-common/vfprintf.c in GNU C Library aka glibc 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string...