CVE-2014-6040

GNU C Library aka glibc before 2.20 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via a multibyte character value of "0xffff" to the iconv function when converting 1 IBM933, 2 IBM935, 3 IBM937, 4 IBM939, or 5 IBM1364 encoded data to UTF-8...

CVE-2012-6656

CVE-2012-6656 affects GNU C Library (glibc) iconvdata/ibm930.c, where iconv converting IBM930 to UTF-8 can trigger an out-of-bounds read by a multibyte value 0xffff. This is a context-dependent denial-of-service vulnerability. The description indicates the issue exists in glibc before version 2.1...

CVE-2014-6040

GNU C Library aka glibc before 2.20 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via a multibyte character value of "0xffff" to the iconv function when converting 1 IBM933, 2 IBM935, 3 IBM937, 4 IBM939, or 5 IBM1364 encoded data to UTF-8...

CVE-2012-6656

iconvdata/ibm930.c in GNU C Library aka glibc before 2.16 allows context-dependent attackers to cause a denial of service out-of-bounds read via a multibyte character value of "0xffff" to the iconv function when converting IBM930 encoded data to UTF-8...

CVE-2014-6040

The CVE-2014-6040 issue affects the GNU C Library (glibc) prior to version 2.20. The vulnerability arises in iconv when converting certain multibyte data (notably IBM933/935/937/939/1364) to UTF-8, allowing a context-dependent attacker to trigger an out-of-bounds read and crash the process, i.e.,...

CVE-2012-6656

iconvdata/ibm930.c in GNU C Library aka glibc before 2.16 allows context-dependent attackers to cause a denial of service out-of-bounds read via a multibyte character value of "0xffff" to the iconv function when converting IBM930 encoded data to UTF-8...

[ MDVSA-2014:232 ] glibc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:232 http://www.mandriva.com/en/support/security/ Package : glibc Date : November 27, 2014 Affected: Business Server 1.0 Problem Description: Updated glibc package fixes security vulnerability: The function...

GNU glibc code execution

wordexp function code execution...

Mandriva Linux Security Advisory : glibc (MDVSA-2014:232)

Updated glibc package fixes security vulnerability : The function wordexp\ fails to properly handle the WRDENOCMD flag when processing arithmetic inputs in the form of $... where ... can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDENOCMD...

Updated glibc packages fix CVE-2014-7817

The function wordexp fails to properly handle the WRDENOCMD flag when processing arithmetic inputs in the form of "$... " where "..." can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDENOCMD forbade command substitution. This allows an attack...

OracleVM 3.3 : glibc (OVMSA-2014-0033)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove gconv transliteration loadable modules support CVE-2014-5119, - nlfindlocale: Improve handling of crafted locale names CVE-2014-0475, - Switch gettimeofday from INTUSE to libchiddenproto 109902...

OracleVM 3.3 : glibc (OVMSA-2014-0017)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove gconv transliteration loadable modules support CVE-2014-5119, - nlfindlocale: Improve handling of crafted locale names CVE-2014-0475, - Don't use alloca in addgetnetgrentX 1087789. - Adjust...

CVE-2014-7817

The wordexp function in GNU C Library aka glibc 2.21 does not enforce the WRDENOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$..."...

Input validation

The wordexp function in GNU C Library aka glibc 2.21 does not enforce the WRDENOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$..."...

CVE-2014-7817

The wordexp function in GNU C Library aka glibc 2.21 does not enforce the WRDENOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$..."...

CVE-2014-7817

The wordexp function in GNU C Library aka glibc 2.21 does not enforce the WRDENOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$..."...

CVE-2014-7817

CVE-2014-7817 affects the GLIBC wordexp function (glibc) where WRDE_NOCMD was not enforced, allowing context-dependent local attackers to execute arbitrary commands via input containing shell substitutions (e.g., $(...)). Public disclosures and vendor advisories (Debian/DSA-3142-1; CentOS CESA no...

CVE-2014-7817

The wordexp function in GNU C Library aka glibc 2.21 does not enforce the WRDENOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$..."...

glibc: command execution

The wordexp function could ignore the WRDENOCMD flag under certain input conditions resulting in the execution of a shell for command substitution when the application did not request it. The implementation now checks WRDENOCMD immediately before executing the shell and returns the error WRDECMDS...

RHEL 6 : rhev-hypervisor6 (RHSA-2012:0109)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0109 advisory. The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization...