CVE-2012-3405 The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to b...
MediumCVSS 5.0
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/glibc(Debian:12) | < 2.13-35 | 2.13-35 |
| debian/glibc(Debian:13) | < 2.13-35 | 2.13-35 |
| debian/glibc(Debian:14) | < 2.13-35 | 2.13-35 |
| GNU glibc | = 2.14 | No fix listed |
| redhat enterprise virtualization | = 3.0 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.10 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
References
- Debian Security Tracker CVE-2012-3405 vendor-advisory
- RHSA-2012:1098 vendor-advisory
- RHSA-2012:1200 vendor-advisory
- [oss-security] 20120711 Re: CVE request: glibc formatted printing vulnerabilities mailing-list
- USN-1589-1 vendor-advisory
- bugzilla.redhat.com
- GLSA-201503-04 vendor-advisory
- sourceware.org
- bugs.debian.org issue-tracking