CVE-2012-3405

2012-07-1300:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.011 Low

EPSS

Percentile

84.0%

JSON

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library
(aka glibc) 2.14 and other versions does not properly calculate a buffer
length, which allows context-dependent attackers to bypass the
FORTIFY_SOURCE format-string protection mechanism and cause a denial of
service (segmentation fault and crash) via a format string with a large
number of format specifiers that triggers “desynchronization within the
buffer size handling,” a different vulnerability than CVE-2012-3404.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/eglibc/+bug/1031301>

Notes

Author	Note
sbeattie	lucid -> oneiric only

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarcheglibc< 2.11.1-0ubuntu7.11UNKNOWN
ubuntu11.04noarcheglibc< 2.13-0ubuntu13.2UNKNOWN
ubuntu11.10noarcheglibc< 2.13-20ubuntu5.2UNKNOWN