The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade eglibcUpgrade glibc | Jul 30, 2024 | Apr 8, 2015 |
| Oracle_linux | — | Upgrade nscdUpgrade glibcUpgrade glibc-staticUpgrade glibc-utilsUpgrade glibc-develUpgrade glibc-commonUpgrade glibc-headers | Oct 16, 2024 | Apr 8, 2015 |
| Suse | — | Upgrade glibc-localeUpgrade glibc-devel-staticUpgrade glibc-langUpgrade glibc-utilsUpgrade nscdUpgrade glibc-locale-32bitUpgrade glibc-develUpgrade glibcUpgrade glibc-htmlUpgrade glibc-devel-32bitUpgrade glibc-locale-base-32bitUpgrade glibc-extraUpgrade glibc-profileUpgrade glibc-32bitUpgrade glibc-locale-baseUpgrade glibc-profile-32bitUpgrade glibc-i18ndataUpgrade glibc-info | Dec 9, 2016 | Apr 8, 2015 |
| Ubuntu | — | Upgrade libc6 | Nov 8, 2024 | Apr 8, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub