CVSS: 7.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-1751 – glibc: array overflow in backtrace functions for powerpc
https://notcve.org/view.php?id=CVE-2020-1751
17 Apr 2020 — An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability. Se encontró una vulnerabilidad de escritura fuera de límites en glibc versiones anteriores a 2.31, cuando se manejaban trampolines de señal en PowerPC. Concre... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751 • CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 4%CPEs: 4EXPL: 0CVE-2020-6096 – Ubuntu Security Notice USN-5310-1
https://notcve.org/view.php?id=CVE-2020-6096
01 Apr 2020 — An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementa... • https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E • CWE-191: Integer Underflow (Wrap or Wraparound) CWE-195: Signed to Unsigned Conversion Error CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 5.7EPSS: 0%CPEs: 16EXPL: 1CVE-2020-10029 – glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions
https://notcve.org/view.php?id=CVE-2020-10029
04 Mar 2020 — The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. La biblioteca GNU C (también se conoce como glibc o libc6) versiones anteriores a 2.32, podría desbordar un búfer sobre la pila durante una reducción de alcance si una entrada a una funci... • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00033.html • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 3.3EPSS: 0%CPEs: 7EXPL: 0CVE-2019-19126 – glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries
https://notcve.org/view.php?id=CVE-2019-19126
19 Nov 2019 — On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program. En la arquitectura de x86-64, la Biblioteca GNU C (también se conoce como glibc) versiones anteriores a 2.31 no omite la variable de entorno de LD_PREFER_MAP_32BIT_EXEC durante la ejecución ... • https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html • CWE-20: Improper Input Validation CWE-665: Improper Initialization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-9192
https://notcve.org/view.php?id=CVE-2019-9192
26 Feb 2019 — In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern ** EN DISPUTA ** EN GNU C Library (también conocido como glibc o libc6), hasta la versión 2.29, check_dst_limits_calc_pos_1 en posix/regexec.c tiene una recursión no controlad... • https://sourceware.org/bugzilla/show_bug.cgi?id=24269 • CWE-674: Uncontrolled Recursion •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 2CVE-2018-20796
https://notcve.org/view.php?id=CVE-2018-20796
26 Feb 2019 — In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep. En la biblioteca GNU C (también conocida como glibc o libc6), hasta la versión 2.29, check_dst_limits_calc_pos_1 en posix/regexec.c tiene una recursión no controlada, tal y como queda demostrado con "(\227|)(\\1\\1|t1|\\\2537)+" en grep. • http://www.securityfocus.com/bid/107160 • CWE-674: Uncontrolled Recursion •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 2CVE-2019-9169 – glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read
https://notcve.org/view.php?id=CVE-2019-9169
26 Feb 2019 — In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. En la biblioteca GNU C (también conocida como glibc o libc6), hasta la versión 2.29, proceed_next_node en posix/regexec.c tiene una sobrelectura de búfer basada en memoria dinámica (heap) mediante un intento de coincidencia de expresiones regulares que no distinguen entre mayúsculas y minúsculas. Red Hat Advanced Cluster Ma... • http://www.securityfocus.com/bid/107160 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 4CVE-2009-5155 – Ubuntu Security Notice USN-4954-1
https://notcve.org/view.php?id=CVE-2009-5155
26 Feb 2019 — In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match. En la biblioteca GNU C (también conocida como glibc o libc6), en versiones anteriores a la 2.28, parse_reg_exp en posix/regcomp.c analiza erróneamente las alternativas, lo que permite que los atacantes provoquen una denegación de serv... • http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272 • CWE-19: Data Processing Errors •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-7309 – Gentoo Linux Security Advisory 202006-04
https://notcve.org/view.php?id=CVE-2019-7309
03 Feb 2019 — In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled. En GNU C Library (también conocido como glibc o libc6), hasta la versión 2.29, la función memcmp para la arquitectura x32 puede devolver cero (indicando que las entradas son iguales) de manera incorrecta debido a que el bit de RDX más significativo se gestiona incorrectamente. Multiple vulne... • http://www.securityfocus.com/bid/106835 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-10739 – glibc: getaddrinfo should reject IP addresses with trailing characters
https://notcve.org/view.php?id=CVE-2016-10739
21 Jan 2019 — In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings. En la biblioteca GNU C Library (también conocida como glibc o libc6) hasta la versión 2.28, la función getaddrinfo analiza exitosamente un... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00082.html • CWE-20: Improper Input Validation •