CVSS: 5.0EPSS: 16%CPEs: 36EXPL: 0CVE-2013-1914 – glibc: Stack (frame) overflow in getaddrinfo() when processing entry mapping to long list of address structures
https://notcve.org/view.php?id=CVE-2013-1914
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results. Desbordamiento de búfer basado en pila en la función getaddrinfo en sysdeps/posix/getaddrinfo.c en GNU C Library (tambien conocido como glibc o libc6) v2.17 y anteriores permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) a través de un (1) nombre de host o (2) una dirección IP que desencadenan un gran número de resultados en la conversión de dominio. It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash. Many Moxa devices suffer from command injection, cross site scripting, and outdated software vulnerabilities. • http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html http://rhn.redhat.com/errata/RHSA-2013-0769.html http://rhn.redhat.com/errata/RHSA-2013-1605.html http://seclists.org/fulldisclosure/2021/Sep/0 http://secunia.com/advisories/52817 http://secunia.com/advisories/55113 http://sourceware.org/bugzilla/show_bug.cgi?id=15330 http://sourceware.org/git/?p=glibc.git%3Ba=commitdiff%3Bh=1cef1b19089528db11f221e938f60b9b048945d7 http://www.mandriva • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2013-0242 – glibc: Buffer overrun (DoS) in regexp matcher by processing multibyte characters
https://notcve.org/view.php?id=CVE-2013-0242
Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters. Desbordamiento de búfer en el metodo extend_buffers del comparador expresiónes regulares (posix / regexec.c) en glibc, posiblemente, v2.17 y anteriores, permite a atacantes dependientes de contexto provocar una denegación de servicio (corrupción de memoria y caída) mediante caracteres multibyte artesanales. A flaw was found in the regular expression matching routines that process multibyte character input. If an application utilized the glibc regular expression matching mechanism, an attacker could provide specially-crafted input that, when processed, would cause the application to crash. • http://osvdb.org/89747 http://rhn.redhat.com/errata/RHSA-2013-0769.html http://rhn.redhat.com/errata/RHSA-2013-1605.html http://secunia.com/advisories/51951 http://secunia.com/advisories/55113 http://sourceware.org/bugzilla/show_bug.cgi?id=15078 http://sourceware.org/ml/libc-alpha/2013-01/msg00967.html http://www.mandriva.com/security/advisories?name=MDVSA-2013:163 http://www.openwall.com/lists/oss-security/2013/01/30/5 http://www.securityfocus.com/bid/57638 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 1CVE-2012-3480 – GNU glibc - Multiple Local Stack Buffer Overflow Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-3480
Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related functions" in stdlib in GNU C Library (aka glibc or libc6) 2.16 allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow. Múltiples desbordamientos de entero en (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, y otras "funciones relacionadas" no especificadas en stdlib en GNU C Library (también conocido como glibc o libc6) v2.16 permite a usuarios locales provocar una denegación de servicio (caída de aplicación) y posiblemente ejecutar código arbitrario a través de una cadena larga, lo que provoca un desbordamiento de búfer basado en pila. • https://www.exploit-db.com/exploits/37631 http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085190.html http://osvdb.org/84710 http://rhn.redhat.com/errata/RHSA-2012-1207.html http://rhn.redhat.com/errata/RHSA-2012-1208.html http://rhn.redhat.com/errata/RHSA-2012-1262.html http://rhn.redhat.com/errata/RHSA-2012-1325.html http://secunia.com/advisories/50201 http://secunia.com/advisories/50422 http://sourceware.org/bugzilla/show_bug.cgi?id=14459 htt • CWE-121: Stack-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 6.8EPSS: 1%CPEs: 8EXPL: 1CVE-2012-3404 – glibc: incorrect size calculation in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
https://notcve.org/view.php?id=CVE-2012-3404
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers. La función vfprintf en stdio-common/vfprintf.c en libc en GNU C Library (también conocido como glibc) 2.12 y otras versiones no calcula correctamente una longitud de buffer, lo que permite a atacantes dependientes de contexto evadir el mecanismo de protección de cadenas de formato FORTIFY_SOURCE y causar una denegación de servicio (corrupción de pila y caída) a través de una cadena de formato que utiliza parámetros posicionales y muchos especificadores de formato. • http://rhn.redhat.com/errata/RHSA-2012-1098.html http://rhn.redhat.com/errata/RHSA-2012-1200.html http://www.openwall.com/lists/oss-security/2012/07/11/17 http://www.ubuntu.com/usn/USN-1589-1 https://bugzilla.redhat.com/show_bug.cgi?id=833703 https://security.gentoo.org/glsa/201503-04 https://sourceware.org/bugzilla/show_bug.cgi?id=12445 https://access.redhat.com/security/cve/CVE-2012-3404 • CWE-189: Numeric Errors •
CVSS: 6.8EPSS: 1%CPEs: 8EXPL: 0CVE-2012-3405 – glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
https://notcve.org/view.php?id=CVE-2012-3405
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404. La función vfprintf en stdio-common/vfprintf.c en libc en GNU C Library (también conocido como glibc) 2.14 y otras versiones no calcula correctamente una longitud de buffer, lo que permite a atacantes dependientes de contexto evadir el mecanismo de protección de cadenas de formato FORTIFY_SOURCE y causar una denegación de servicio (fallo de segmentación y caída) a través de una cadena de formato con un gran número de especificadores de formato que provoca "desincronización dentro del manejo del tamaño de buffer," una vulnerabilidad deferente a CVE-2012-3404. • http://rhn.redhat.com/errata/RHSA-2012-1098.html http://rhn.redhat.com/errata/RHSA-2012-1200.html http://www.openwall.com/lists/oss-security/2012/07/11/17 http://www.ubuntu.com/usn/USN-1589-1 https://bugzilla.redhat.com/show_bug.cgi?id=833704 https://security.gentoo.org/glsa/201503-04 https://sourceware.org/bugzilla/show_bug.cgi?id=13446 https://access.redhat.com/security/cve/CVE-2012-3405 • CWE-189: Numeric Errors •