GNU C Library Security Bypass Vulnerability

The GNU C Library glibc, libc6 is an open-source, free C compiler released under the LGPL license. A security vulnerability exists in glibc in the GNU C Library. An attacker can exploit this vulnerability to bypass ASLR...

DEBIAN-CVE-2019-1010022

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this ...

PT-2019-11441 · Gnu +1 · Glibc +1

Name of the Vulnerable Software and Affected Versions: glibc affected versions not specified Description: The issue concerns a mitigation bypass in glibc, allowing an attacker to potentially guess the heap addresses of pthread-created threads. The vendor's stance is that ASLR bypass itself is not...

PT-2019-11440 · Gnu +1 · Glibc +1

Name of the Vulnerable Software and Affected Versions: GNU Libc affected versions not specified Description: The issue is related to a mitigation bypass, where an attacker may bypass ASLR using the cache of thread stack and heap. The component affected is glibc. It is noted that upstream comments...

Integer Overflow

GNU C Library is vulnerable to integer overflow attacks. This occurs in the posixmemalign in memalign functions when return a pointer to a heap area because heap area is too small which may leads to a heap corruption...

Buffer Overflow

GNU C Library is vulnerable to buffer overflow attacks. This occurs in the mempcpyavx512novzeroupper function when particular conditions are met. An attacker could use this vulnerability to cause a denial of service or potentially execute code...

Arbitrary Code Execution

GNU C Library is vulnerable to arbitrary code execution. A remote unauthenticated attacker could cause a buffer overflow during unescaping of user names with the operator resulting in denial of service conditions and code execution attacks...

DNS Spoofing

GNU C Library is vulnerable to DNS spoofing attacks. A remote unauthenticated attacker could potentially simplify off-path DNS spoofing attacks due to IP fragmentation. This affects some unknown processing of the component EDNS Support...

CVE-2005-3590

The getgrouplist function in the GNU C library glibc before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory...

Arbitrary Code Execution

GNU C Library is vulnerable to arbitrary code execution. An attacker could use the unsanitized LDPOINTERGUARD environment variable to bypass the pointer guarding protection on set-user-ID or set-group-ID programs to execute arbitrary code with the permissions of the user running the application...

Denial Of Service (DoS)

GNU C Library is vulnerable to denial of service DoS attacks. An out-of-range time values passed to the strftime function could result in an out-of-bounds memory access allowing attackers to cause a application crash or possibly obtain sensitive information...

Denial Of Service (DoS)

GNU C Library is vulnerable to denial of service DoS attacks. Use of a long catalog name in the catopen function may cause a stack-based buffer overflow allowing a context-dependent attacker to cause denial of service via an application crash or possible execution of arbitrary code...

Arbitrary Code Execution And Denial Of Service (DoS)

GNU C Library is vulnerable to arbitrary code execution and denial of service. An context-dependent attacker could trigger an out-of-bounds heap-memory access via the size argument to the hcreater function to cause a denial of service or possibly execute arbitrary code...

CVE-2005-3590

The getgrouplist function in the GNU C library glibc before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory...

CVE-2006-7254

The nscd daemon in the GNU C Library glibc before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon, allowing local users to carry out a denial of service attack on the daemon...

DEBIAN-CVE-2006-7254

The nscd daemon in the GNU C Library glibc before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon, allowing local users to carry out a denial of service attack on the daemon...

CVE-2005-3590

The getgrouplist function in the GNU C library glibc before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory...

CVE-2006-7254

The nscd daemon in the GNU C Library glibc before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon, allowing local users to carry out a denial of service attack on the daemon...

CVE-2006-7254

The CVE concerns the nscd daemon in the GNU C Library (glibc) prior to 2.5. The vulnerability arises because nscd does not close incoming client sockets that it cannot handle, enabling local users to perform a denial of service against the daemon. Affected component: nscd within glibc (before 2.5...

CVE-2005-3590

The getgrouplist function in the GNU C library glibc before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory...