Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2011-2702 — Code Injection in Eglibc

CWE-94 — Code Injection9 documents8 sources
Severity
6.8MEDIUMNVD
EPSS
3.4%
top 12.66%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
GNU EglibcGNU Glibc
Timeline
PublishedOct 27
Latest updateMay 17

Description

Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows context-dependent attackers to execute arbitrary code via a negative length parameter to (1) memcpy-ssse3-rep.S, (2) memcpy-ssse3.S, or (3) memset-sse2.S in sysdeps/i386/i686/multiarch/, which triggers an out-of-bounds read, as demonstrated using the memcpy function.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶NVDgnu/eglibc2.12
▶NVDgnu/glibc2.12.2+2

🔴Vulnerability Details

3
GHSA
GHSA-r955-5974-3x3p: Integer signedness error in Glibc before 2↗2022-05-17
▶
CVEList
CVE-2011-2702: Integer signedness error in Glibc before 2↗2014-10-27
▶
OSV
CVE-2011-1094: kio/kio/tcpslavebase↗2011-03-16
▶

💥Exploits & PoCs

1
Exploit-DB
eGlibc - Signedness Code Execution↗2012-08-01
▶

📋Vendor Advisories

4
Ubuntu
GNU C Library vulnerabilities↗2012-03-09
▶
Red Hat
kdelibs: SSL certificate for IP address accepted as valid for hosts that resolve to the IP↗2011-01-31
▶
Debian
CVE-2011-2702: glibc - Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using...↗2011
▶
Red Hat
CVE-2011-2702: Integer signedness error in Glibc before 2↗
▶
CVE-2011-2702 — Code Injection in GNU Eglibc | cvebase