CVE-2012-3406 The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPE...
MediumCVSS 6.8
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/glibc(Debian:12) | < 2.19-14 | 2.19-14 |
| debian/glibc(Debian:13) | < 2.19-14 | 2.19-14 |
| debian/glibc(Debian:14) | < 2.19-14 | 2.19-14 |
| GNU glibc | = 2.5 | No fix listed |
| GNU glibc | = 2.12 | No fix listed |
| redhat enterprise virtualization | = 3.0 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.10 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| redhat enterprise linux | = 5 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
References
- Debian Security Tracker CVE-2012-3406 vendor-advisory
- RHSA-2012:1097 vendor-advisory
- RHSA-2012:1098 vendor-advisory
- RHSA-2012:1185 vendor-advisory
- RHSA-2012:1200 vendor-advisory
- [oss-security] 20120711 Re: CVE request: glibc formatted printing vulnerabilities mailing-list
- USN-1589-1 vendor-advisory
- bugzilla.redhat.com
- bugzilla.redhat.com
- GLSA-201503-04 vendor-advisory
- bugs.debian.org issue-tracking