Risk | Low |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2019-6488 CVE-2009-5155 |
CWE-ID | CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Glibc Universal components / Libraries / Libraries used by multiple products |
Vendor | GNU |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU17106
Risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-6488
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy due to application that runs on the x32 architecture incorrectly attempts to use a 64-bit register for size_t in assembly codes. A remote attacker can pass specially crafted data to the application using an affected library and cause segmentation fault.
Install updates from vendor's website.
Vulnerable software versionsGlibc: 1.00 - 2.28
External linkshttp://sourceware.org/bugzilla/show_bug.cgi?id=24097
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU17885
Risk: Low
CVSSv3.1: 5.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2009-5155
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input passed to parse_reg_exp() function in posix/regcomp.c . A local user can send specially crafted input to application that uses the affected version of glibc and perform denial of service attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGlibc: 1.00 - 2.27
External linkshttp://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238
http://sourceware.org/bugzilla/show_bug.cgi?id=11053
http://sourceware.org/bugzilla/show_bug.cgi?id=18986
http://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.