CVE-2008-1391
published 2008-03-27CVE-2008-1391: Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to…
PriorityP354high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
18.80%
97.0th percentile
Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.
Affected
65 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.11.1-1 (bookworm) | glibc 2.11.1-1 (bookworm) |
| debian | glibc | < glibc 2.11-1 (bookworm) | glibc 2.11-1 (bookworm) |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| gnu | glibc | <= 2.10.1 | — |
| gnu | glibc | <= 2.9 | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2010-05-25·CVSS 7.5
CVE-2010-0296 [HIGH] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: The GNU C library did not correctly handle certain mnt entries, strfmon
arguments, and ELF program headers.
Maksymilian Arciemowicz discovered that the GNU C library did not
correctly handle integer overflows in the strfmon function. If a user
or automated system were tricked into processing a specially crafted
format string, a remote attacker could crash applications, leading to
a denial of service. (Ubuntu 10.04 was not affected.) (CVE-2008-1391)
Jeff Layton and Dan Rosenberg discovered that the GNU C library did not
correctly handle newlines in the mntent family of functions. If a local
attacker were able to inject newlines into a mount entry through other
vulnerable mount helpers, they could disrupt the system or possibly gain
root privi
Red Hat
(32-bit): Multiple integer overflows in the printf implementation
vendor_redhat·2009-09-03·CVSS 7.5
CVE-2009-4880 [HIGH] CWE-190 (32-bit): Multiple integer overflows in the printf implementation
(32-bit): Multiple integer overflows in the printf implementation
Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391.
Statement: Red Hat does not consider this bug to be a security issue. Properly written application should not use arbitrary untrusted data as part of the format string passed to functions as strfmon or printf family functions.
Debian
CVE-2009-4880: glibc - Multiple integer overflows in the strfmon implementation in the GNU C Library (a...
vendor_debian·2009·CVSS 7.5
CVE-2009-4880 [HIGH] CVE-2009-4880: glibc - Multiple integer overflows in the strfmon implementation in the GNU C Library (a...
Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391.
Scope: local
bookworm: resolved (fixed in 2.11.1-1)
bullseye: resolved (fixed in 2.11.1-1)
forky: resolved (fixed in 2.11.1-1)
sid: resolved (fixed in 2.11.1-1)
trixie: resolved (fixed in 2.11.1-1)
Debian
CVE-2009-4881: glibc - Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfm...
vendor_debian·2009·CVSS 7.5
CVE-2009-4881 [HIGH] CVE-2009-4881: glibc - Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfm...
Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.
Scope: local
bookworm: resolved (fixed in 2.11.1-1)
bullseye: resolved (fixed in 2.11.1-1)
forky: resolved (fixed in 2.11.1-1)
sid: resolved (fixed in 2.11.1-1)
trixie: resolved (fixed in 2.11.1-1)
Red Hat
(32-bit): Integer overflow in the __vstrfmon_l function
vendor_redhat·2008-03-25·CVSS 7.5
CVE-2009-4881 [HIGH] CWE-190 (32-bit): Integer overflow in the __vstrfmon_l function
(32-bit): Integer overflow in the __vstrfmon_l function
Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.
Statement: Red Hat does not consider this bug to be a security issue. Properly written application should not use arbitrary untrusted data as part of the format string passed to functions as strfmon or printf family functions.
Red Hat
glibc: strfmon format string problem
vendor_redhat·2008-03-25·CVSS 7.5
CVE-2008-1391 [HIGH] glibc: strfmon format string problem
glibc: strfmon format string problem
Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.
Statement: Red Hat does not consider this to be a security issue. Properly written
application should not use arbitrary untrusted data as part of the format
string passed to functions as strfmon or printf family functions.
Debian
CVE-2008-1391: glibc - Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and proba...
vendor_debian·2008·CVSS 7.5
CVE-2008-1391 [HIGH] CVE-2008-1391: glibc - Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and proba...
Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.
Scope: local
bookworm: resolved (fixed in 2.11-1)
bullseye: resolved (fixed in 2.11-1)
forky: resolved (fixed in 2.11-1)
sid: resolved (fixed in 2.11-1)
trixie: resolved (fixed in 2.11-1)
GHSA
GHSA-q4g7-ccjm-h2xx: Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l
ghsa_unreviewed·2022-05-02·CVSS 7.5
CVE-2009-4881 [HIGH] GHSA-q4g7-ccjm-h2xx: Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l
Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.
GHSA
GHSA-362p-9mx3-r47m: Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2
ghsa_unreviewed·2022-05-02·CVSS 7.5
CVE-2009-4880 [HIGH] GHSA-362p-9mx3-r47m: Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2
Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391.
GHSA
GHSA-7w79-2w84-7wvc: Multiple integer overflows in libc in NetBSD 4
ghsa_unreviewed·2022-05-01
CVE-2008-1391 [HIGH] GHSA-7w79-2w84-7wvc: Multiple integer overflows in libc in NetBSD 4
Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.
OSV
CVE-2009-4881: Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l
osv·2010-06-01·CVSS 7.5
CVE-2009-4881 [HIGH] CVE-2009-4881: Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l
Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.
OSV
CVE-2009-4880: Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2
osv·2010-06-01·CVSS 7.5
CVE-2009-4880 [HIGH] CVE-2009-4880: Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2
Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391.
OSV
CVE-2008-1391: Multiple integer overflows in libc in NetBSD 4
osv·2008-03-27·CVSS 7.5
CVE-2008-1391 [HIGH] CVE-2008-1391: Multiple integer overflows in libc in NetBSD 4
Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.
No detection rules found.
Bugzilla
CVE-2009-4881 glibc (32-bit): Integer overflow in the __vstrfmon_l function
bugzilla·2010-06-02·CVSS 7.5
CVE-2009-4881 [HIGH] CVE-2009-4881 glibc (32-bit): Integer overflow in the __vstrfmon_l function
CVE-2009-4881 glibc (32-bit): Integer overflow in the __vstrfmon_l function
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4881 to
the following vulnerability:
Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in
the strfmon implementation in the GNU C Library (aka glibc or libc6)
before 2.10.1 allows context-dependent attackers to cause a denial of
service (application crash) via a crafted format string, as
demonstrated by the %99999999999999999999n string, a related issue to
CVE-2008-1391.
References:
[1] http://sources.redhat.com/bugzilla/show_bug.cgi?id=10600
[2] http://sourceware.org/git/?p=glibc.git;a=commit;h=153aa31b93be22e01b236375fb02a9f9b9a0195f
[3] http://sources.redhat.com/bugzilla/show_bug.cgi?id=10600
[4] http://securityreason.com/a
Bugzilla
CVE-2009-4880 glibc (32-bit): Multiple integer overflows in the printf implementation
bugzilla·2010-06-02·CVSS 7.5
CVE-2009-4880 [HIGH] CVE-2009-4880 glibc (32-bit): Multiple integer overflows in the printf implementation
CVE-2009-4880 glibc (32-bit): Multiple integer overflows in the printf implementation
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4880 to
the following vulnerability:
Multiple integer overflows in the strfmon implementation in the GNU C
Library (aka glibc or libc6) 2.10.1 and earlier allow
context-dependent attackers to cause a denial of service (memory
consumption or application crash) via a crafted format string, as
demonstrated by a crafted first argument to the money_format function
in PHP, a related issue to CVE-2008-1391.
References:
[1] http://securityreason.com/achievement_securityalert/67
[2] https://bugzilla.redhat.com/show_bug.cgi?id=524671
[3] http://sources.redhat.com/bugzilla/show_bug.cgi?id=10600
[4] http://sourceware.org/git/?p=glibc.git;a=commit
Bugzilla
CVE-2008-1391 glibc: strfmon format string problem
bugzilla·2009-09-21·CVSS 7.5
CVE-2008-1391 [HIGH] CVE-2008-1391 glibc: strfmon format string problem
CVE-2008-1391 glibc: strfmon format string problem
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1391 to
the following vulnerability:
Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1391
https://bugzilla.novell.com/show_bug.cgi?id=375315
http://www.securityfocus.com/bid/36443/references
http://securityreason.com/achievement_securityalert/67
Discus
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.chttp://lists.apple.com/archives/security-announce//2008//Dec/msg00000.htmlhttp://secunia.com/advisories/29574http://secunia.com/advisories/33179http://securityreason.com/achievement_securityalert/53http://securityreason.com/securityalert/3770http://support.apple.com/kb/HT3338http://www.debian.org/security/2010/dsa-2058http://www.securityfocus.com/archive/1/490158/100/0/threadedhttp://www.securityfocus.com/bid/28479http://www.securitytracker.com/id?1019722http://www.us-cert.gov/cas/techalerts/TA08-350A.htmlhttp://www.vupen.com/english/advisories/2008/3444https://exchange.xforce.ibmcloud.com/vulnerabilities/41504https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.htmlhttp://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.chttp://lists.apple.com/archives/security-announce//2008//Dec/msg00000.htmlhttp://secunia.com/advisories/29574http://secunia.com/advisories/33179http://securityreason.com/achievement_securityalert/53http://securityreason.com/securityalert/3770http://support.apple.com/kb/HT3338http://www.debian.org/security/2010/dsa-2058http://www.securityfocus.com/archive/1/490158/100/0/threadedhttp://www.securityfocus.com/bid/28479http://www.securitytracker.com/id?1019722http://www.us-cert.gov/cas/techalerts/TA08-350A.htmlhttp://www.vupen.com/english/advisories/2008/3444https://exchange.xforce.ibmcloud.com/vulnerabilities/41504https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.html
2008-03-27
Published