CVE-2012-2677 Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflo...
MediumCVSS 5.0
EPSS 3.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be allocated than expected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft azure linux | < 8.0.40-4 | 8.0.40-4 |
| boost pool | <= 1.0.0 | No fix listed |
| boost pool | = 2.0.0 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- mysql vendor-advisory
- kqueue.org
- FEDORA-2012-9029 vendor-advisory
- FEDORA-2012-9818 vendor-advisory
- MDVSA-2013:065 vendor-advisory
- [oss-security] 20120605 memory allocator upstream patches mailing-list
- [oss-security] 20120607 Re: memory allocator upstream patches mailing-list
- GLSA-202105-04 vendor-advisory
- svn.boost.org exploit patch
- svn.boost.org