GNU » Glibc : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2023-25139	787	Overflow	2023-02-03	2023-03-02	0.0	None	???	???	???	???	???	???
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
2	CVE-2023-0687	120	Overflow	2023-02-06	2023-02-24	4.0	None	Local Network	High	???	Partial	Partial	Partial
DISPUTED A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.
3	CVE-2022-39046	532		2022-08-31	2022-12-08	0.0	None	???	???	???	???	???	???
An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.
4	CVE-2022-23219	120	DoS Exec Code Overflow	2022-01-14	2022-11-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
5	CVE-2022-23218	120	DoS Exec Code Overflow	2022-01-14	2022-11-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
6	CVE-2021-43396			2021-11-04	2023-02-24	5.0	None	Remote	Low	Not required	None	Partial	None
DISPUTED In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug."
7	CVE-2021-38604	476		2021-08-12	2022-09-28	5.0	None	Remote	Low	Not required	None	None	Partial
In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.
8	CVE-2021-35942	190	DoS	2021-07-22	2022-11-08	6.4	None	Remote	Low	Not required	Partial	None	Partial
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.
9	CVE-2021-33574	416	DoS	2021-05-25	2022-11-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.
10	CVE-2021-27645	415	DoS	2021-02-24	2022-11-04	1.9	None	Local	Medium	Not required	None	None	Partial
The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
11	CVE-2021-3999	193	Exec Code Overflow Mem. Corr.	2022-08-24	2023-02-12	0.0	None	???	???	???	???	???	???
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
12	CVE-2021-3998	125	+Info	2022-08-24	2023-02-12	0.0	None	???	???	???	???	???	???
A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.
13	CVE-2021-3326	617	DoS	2021-01-27	2022-11-04	5.0	None	Remote	Low	Not required	None	None	Partial
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
14	CVE-2020-29573	787	Overflow	2020-12-06	2023-04-26	5.0	None	Remote	Low	Not required	None	None	Partial
sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.
15	CVE-2020-29562	617	DoS	2020-12-04	2021-03-19	2.1	None	Remote	High	???	None	None	Partial
The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
16	CVE-2020-27618	835	DoS	2021-02-26	2022-10-28	2.1	None	Local	Low	Not required	None	None	Partial
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.
17	CVE-2020-10029	787	Overflow	2020-03-04	2022-11-10	2.1	None	Local	Low	Not required	None	None	Partial
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
18	CVE-2020-6096	195	Exec Code	2020-04-01	2022-11-21	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.
19	CVE-2020-1752	416	Exec Code	2020-04-30	2022-10-28	3.7	None	Local	High	Not required	Partial	Partial	Partial
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.
20	CVE-2020-1751	787	DoS Exec Code	2020-04-17	2023-01-27	5.9	None	Local	Medium	Not required	Partial	Partial	Complete
An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.
21	CVE-2019-1010025	330	Bypass	2019-07-15	2020-11-16	5.0	None	Remote	Low	Not required	Partial	None	None
DISPUTED GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."
22	CVE-2019-1010024	200	Bypass +Info	2019-07-15	2020-11-16	5.0	None	Remote	Low	Not required	Partial	None	None
DISPUTED GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."
23	CVE-2019-1010023		Exec Code	2019-07-15	2020-11-16	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
DISPUTED GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."
24	CVE-2019-1010022	119	Overflow Bypass	2019-07-15	2021-06-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
DISPUTED GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."
25	CVE-2019-25013	125		2021-01-04	2022-11-03	7.1	None	Remote	Medium	Not required	None	None	Complete
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.
26	CVE-2019-19126	665	Bypass	2019-11-19	2022-11-08	2.1	None	Local	Low	Not required	Partial	None	None
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.
27	CVE-2019-9192	674		2019-02-26	2020-08-24	5.0	None	Remote	Low	Not required	None	None	Partial
DISPUTED In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.
28	CVE-2019-9169	125		2019-02-26	2022-06-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
29	CVE-2019-7309			2019-02-03	2020-08-24	2.1	None	Local	Low	Not required	None	None	Partial
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
30	CVE-2019-6488	404		2019-01-18	2020-06-13	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.
31	CVE-2018-1000001	787	Exec Code	2018-01-31	2019-10-03	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
32	CVE-2018-20796	674		2019-02-26	2019-11-05	5.0	None	Remote	Low	Not required	None	None	Partial
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227\|)(\\1\\1\|t1\|\\\2537)+' in grep.
33	CVE-2018-19591	20		2018-12-04	2020-07-09	5.0	None	Remote	Low	Not required	None	None	Partial
In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.
34	CVE-2018-11237	787	Overflow	2018-05-18	2022-09-13	4.6	None	Local	Low	Not required	Partial	Partial	Partial
An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.
35	CVE-2018-11236	787	Exec Code Overflow	2018-05-18	2020-08-24	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
36	CVE-2018-6551	787		2018-02-02	2020-08-24	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.
37	CVE-2018-6485	787	Overflow	2018-02-01	2020-08-24	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.
38	CVE-2017-1000409	119	Overflow	2018-02-01	2019-04-04	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
39	CVE-2017-1000408	772		2018-02-01	2019-10-03	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
40	CVE-2017-1000366	119	Exec Code Overflow	2017-06-19	2020-10-15	7.2	None	Local	Low	Not required	Complete	Complete	Complete
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
41	CVE-2017-17426	190	Overflow	2017-12-05	2017-12-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
42	CVE-2017-16997	426	+Priv	2017-12-18	2020-10-15	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
43	CVE-2017-15804	119	Overflow	2017-10-22	2018-06-20	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.
44	CVE-2017-15671	772	DoS	2017-10-20	2019-10-03	4.3	None	Remote	Medium	Not required	None	None	Partial
The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).
45	CVE-2017-15670	119	Overflow	2017-10-20	2018-06-20	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string.
46	CVE-2017-12133	416		2017-09-07	2020-07-09	4.3	None	Remote	Medium	Not required	None	Partial	None
Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path.
47	CVE-2017-12132	770		2017-08-01	2019-10-03	4.3	None	Remote	Medium	Not required	None	Partial	None
The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation.
48	CVE-2017-8804	502	DoS	2017-05-07	2020-08-26	7.8	None	Remote	Low	Not required	None	None	Complete
DISPUTED The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references]
49	CVE-2016-10739	20		2019-01-21	2019-08-06	4.6	None	Local	Low	Not required	Partial	Partial	Partial
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.
50	CVE-2016-10228	20	DoS	2017-03-02	2022-10-17	4.3	None	Remote	Medium	Not required	None	None	Partial
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

Total number of vulnerabilities : 134 Page : 1 (This Page)2 3