CVE-2010-3856

ld.so in the GNU C Library aka glibc or libc6 before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LDAUDIT environment variable to reference dynamic shared objects DSOs as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a...

Stack overflow

Certain run-time memory protection mechanisms in the GNU C Library aka glibc or libc6 print argv0 and backtrace information, which might allow context-dependent attackers to obtain sensitive information from process memory by executing an incorrect program, as demonstrated by a setuid program tha...

CVE-2010-3192

CVE-2010-3192 affects the GNU C Library (glibc) and concerns runtime memory protection that prints argv[0] and backtrace data, potentially allowing a context-dependent attacker to read sensitive process memory. The description references a setuid program with a stack-based overflow (fortify_fail/...

CVE-2010-0296

The encodename macro in misc/mntentr.c in the GNU C Library aka glibc or libc6 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service mtab corruption, or possibly modify mount...

CVE-2009-4881

CVE-2009-4881 is a glibc (GNU C Library) vulnerability describing an integer overflow in the __vstrfmon_l function of strfmon_l.c, prior to glibc-2.10.1. The connected advisories (Gentoo GLSA-201011-01, openSUSE/SUSE updates) group it with several related glibc flaws (CVE-2008-1391, 2010-0296, 20...

CVE-2010-0296

CVE-2010-0296 concerns the GNU C Library (glibc) up to version 2.11.1. The encode_name macro in misc/mntent_r.c fails to handle newline characters in mountpoint names, used by ncpmount and mount.cifs, leading to potential mtab corruption and, via crafted mount requests, local privilege elevation....

CVE-2010-0830

CVE-2010-0830 describes an integer signedness error in the GNU C Library’s dynamic linker component ld.so, specifically in elf_get_dynamic_info. The vulnerability affects glibc versions 2.0.1 through 2.11.1, and is triggered when using the --verify option. A crafted ELF binary with a negative d_t...

CVE-2009-4880

Glibc (GNU C Library) is affected by CVE-2009-4880: multiple integer overflows in strfmon handling that can be triggered by a crafted format string, potentially causing memory growth or an application crash (denial of service). This is observed in glibc 2.10.1 and earlier. Mitigation per connecte...

CVE-2010-0015

nis/nssnis/nis-pwd.c in the GNU C Library aka glibc or libc6 2.7 and Embedded GLIBC EGLIBC 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function...

CVE-2010-0015

CVE-2010-0015 affects the GNU C Library (glibc) and Embedded GLIBC (EGLIBC): in glibc 2.7 and EGLIBC 2.10.2, the NIS path (passwd.adjunct.byname) can cause getpwnam() to reveal encrypted NIS passwords. The connected advisories (Ubuntu USN-1396-1, SUSE patches) document this vulnerability and prov...

Debian Security Advisory DSA 282-1 (glibc)

The remote host is missing an update to glibc announced via advisory DSA 282-1. OpenVAS Vulnerability Test $Id: deb2821.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 282-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 149-2 (glibc)

The remote host is missing an update to glibc announced via advisory DSA 149-2. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 149-1 (glibc)

The remote host is missing an update to glibc announced via advisory DSA 149-1. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Ubuntu 4.10 : Standard C library script vulnerabilities (USN-4-1)

Recently, Trustix Secure Linux discovered some vulnerabilities in the libc6 package. The utilities 'catchsegv' and 'glibcbug' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Not...

Debian DSA-636-1 : glibc - insecure temporary files

Several insecure uses of temporary files have been discovered in support scripts in the libc6 package which provides the c library for a GNU/Linux system. Trustix developers found that the catchsegv script uses temporary files insecurely. Openwall developers discovered insecure temporary files in...

[SECURITY] [DSA 636-1] New libc6 packages fix insecure temporary files

-------------------------------------------------------------------------- Debian Security Advisory DSA 636-1 [email protected] http://www.debian.org/security/ Martin Schulze January 12th, 2005 http://www.debian.org/security/faq -...

DSA-636-1 glibc - insecure temporary files

Bulletin has no description...

USN-4-1: Standard C library script vulnerabilities

Recently, Trustix Secure Linux discovered some vulnerabilities in the libc6 package. The utilities "catchsegv" and "glibcbug" created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program...

Debian DSA-282-1 : glibc - integer overflow

eEye Digital Security discovered an integer overflow in the xdrmemgetbytes function which is also present in GNU libc. This function is part of the XDR external data representation encoder/decoder derived from Sun's RPC implementation. Depending upon the application, this vulnerability can cause...

Debian DSA-149-1 : glibc - integer overflow

An integer overflow bug has been discovered in the RPC library used by GNU libc, which is derived from the SunRPC library. This bug could be exploited to gain unauthorized root access to software linking to this code. The packages below also fix integer overflows in the malloc code. They also...