CVSS: 5.0EPSS: 16%CPEs: 36EXPL: 0CVE-2013-1914 – glibc: Stack (frame) overflow in getaddrinfo() when processing entry mapping to long list of address structures
https://notcve.org/view.php?id=CVE-2013-1914
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results. Desbordamiento de búfer basado en pila en la función getaddrinfo en sysdeps/posix/getaddrinfo.c en GNU C Library (tambien conocido como glibc o libc6) v2.17 y anteriores permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) a través de un (1) nombre de host o (2) una dirección IP que desencadenan un gran número de resultados en la conversión de dominio. It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash. Many Moxa devices suffer from command injection, cross site scripting, and outdated software vulnerabilities. • http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html http://rhn.redhat.com/errata/RHSA-2013-0769.html http://rhn.redhat.com/errata/RHSA-2013-1605.html http://seclists.org/fulldisclosure/2021/Sep/0 http://secunia.com/advisories/52817 http://secunia.com/advisories/55113 http://sourceware.org/bugzilla/show_bug.cgi?id=15330 http://sourceware.org/git/?p=glibc.git%3Ba=commitdiff%3Bh=1cef1b19089528db11f221e938f60b9b048945d7 http://www.mandriva • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2010-3192
https://notcve.org/view.php?id=CVE-2010-3192
Certain run-time memory protection mechanisms in the GNU C Library (aka glibc or libc6) print argv[0] and backtrace information, which might allow context-dependent attackers to obtain sensitive information from process memory by executing an incorrect program, as demonstrated by a setuid program that contains a stack-based buffer overflow error, related to the __fortify_fail function in debug/fortify_fail.c, and the __stack_chk_fail (aka stack protection) and __chk_fail (aka FORTIFY_SOURCE) implementations. Algunos mecanismos run-time de protección de memoria en la Librería C de GNU (también conocido como glibc o libc6) print argv[0] y backtrace information, lo cual permite a atacantes dependientes del contexto obtener información sensible de procesos de memoria mediante la ejecución de un programa incorrecto, como el demostrado por un programa setuid que contiene un error de desbordamiento de búfer basado en pila, relacionado con la función __fortify_fail en debug/fortify_fail.c, y las implementaciones __stack_chk_fail (también conocida como stack protection) y __chk_fail (también conocida como FORTIFY_SOURCE). • http://seclists.org/fulldisclosure/2010/Apr/399 http://www.openwall.com/lists/oss-security/2010/08/25/8 http://www.openwall.com/lists/oss-security/2010/08/31/6 http://www.openwall.com/lists/oss-security/2010/08/31/7 http://www.openwall.com/lists/oss-security/2010/09/02/2 http://www.openwall.com/lists/oss-security/2010/09/02/3 http://www.openwall.com/lists/oss-security/2010/09/02/4 http://www.openwall.com/lists/oss-security/2010/09/02/5 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •