Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2010-4051 — Glibc vulnerability
8 documents8 sources
Severity
5.0MEDIUMNVD
EPSS
4.7%
top 10.67%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedJan 13
Latest updateMay 13
Description
The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow."
CVSS vector
AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-6429-fc4p-f7q7: The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2↗2022-05-13
CVEList▶
CVE-2010-4051: The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2↗2011-01-13
OSV▶
CVE-2010-4051: The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2↗2011-01-13