CVE-2012-3404
published 2014-02-10CVE-2012-3404: The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length…
PriorityP425medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
2.23%
82.6th percentile
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | glibc | < glibc 2.19-14 (bookworm) | glibc 2.19-14 (bookworm) |
| debian | glibc | < glibc 2.13-35 (bookworm) | glibc 2.13-35 (bookworm) |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | >= 0 < 2.13-35 | 2.13-35 |
| gnu | glibc | >= 0 < 2.19-14 | 2.19-14 |
| gnu | glibc | >= 0 < 2.13-35 | 2.13-35 |
| gnu | glibc | >= 0 < 2.19-14 | 2.19-14 |
| gnu | glibc | >= 0 < 2.13-35 | 2.13-35 |
| gnu | glibc | >= 0 < 2.19-14 | 2.19-14 |
| gnu | glibc | >= 0 < 2.13-35 | 2.13-35 |
| gnu | glibc | >= 0 < 2.19-14 | 2.19-14 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_virtualization | — | — |
| vmware | vcenter_server | — | — |
| vmware | vmware_esxi | — | — |
| vmware | vsphere | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware security updates for vCSA, vCenter Server, and ESXi
vendor_vmware·2012-12-20·CVSS 4.0
CVE-2009-5029 [MEDIUM] VMware security updates for vCSA, vCenter Server, and ESXi
VMSA-2012-0018: VMware security updates for vCSA, vCenter Server, and ESXi
a. vCenter Server Appliance directory traversal The vCenter Server Appliance (vCSA) contains a directory traversal vulnerability that allows an authenticated remote user to retrieve arbitrary files. Exploitation of this issue may expose sensitive information stored on the server. VMware would like to thank Alexander Minozhenko from ERPScan for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-6324 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Product Version Running on Replace with/ Apply Patch VMware Product vCSA Product Vers
Ubuntu
GNU C Library regression
vendor_ubuntu·2012-12-17·CVSS 5.0
CVE-2012-3480 [MEDIUM] GNU C Library regression
Title: GNU C Library regression
Summary: USN-1589-1 exposed a regression in the GNU C Library floating point parser.
USN-1589-1 fixed vulnerabilities in the GNU C Library. One of the updates
exposed a regression in the floating point parser. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that positional arguments to the printf() family
of functions were not handled properly in the GNU C Library. An
attacker could possibly use this to cause a stack-based buffer
overflow, creating a denial of service or possibly execute arbitrary
code. (CVE-2012-3404, CVE-2012-3405, CVE-2012-3406)
It was discovered that multiple integer overflows existed in the
strtod(), strtof() and strtold() functions in the GNU C Library. An
attacker c
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2012-10-02·CVSS 5.0
CVE-2012-3404 [MEDIUM] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Multiple security issues were fixed in the GNU C Library.
It was discovered that positional arguments to the printf() family
of functions were not handled properly in the GNU C Library. An
attacker could possibly use this to cause a stack-based buffer
overflow, creating a denial of service or possibly execute arbitrary
code. (CVE-2012-3404, CVE-2012-3405, CVE-2012-3406)
It was discovered that multiple integer overflows existed in the
strtod(), strtof() and strtold() functions in the GNU C Library. An
attacker could possibly use this to trigger a stack-based buffer
overflow, creating a denial of service or possibly execute arbitrary
code. (CVE-2012-3480)
Instructions: After a standard system update you need to reboot your computer to make
al
Red Hat
glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
vendor_redhat·2012-07-11·CVSS 5.0
CVE-2012-3405 [MEDIUM] glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.
Statement: This issue did not affect the version of glibc as shipped with Red Hat Enterprise Linux 5.
Package: glibc (Red Hat Enterprise Linux 5) - Not affected
Red Hat
glibc: incorrect size calculation in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
vendor_redhat·2012-07-11·CVSS 5.0
CVE-2012-3404 [MEDIUM] glibc: incorrect size calculation in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
glibc: incorrect size calculation in formatted printing can lead to FORTIFY_SOURCE format string protection bypass
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.
Statement: This issue did not affect the version of glibc as shipped with Red Hat Enterprise Linux 5.
Package: glibc (Red Hat Enterprise Linux 5) - Not affected
Red Hat
glibc: printf() unbound alloca() usage in case of positional parameters + many format specs
vendor_redhat·2012-07-11·CVSS 5.0
CVE-2012-3406 [MEDIUM] glibc: printf() unbound alloca() usage in case of positional parameters + many format specs
glibc: printf() unbound alloca() usage in case of positional parameters + many format specs
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
Debian
CVE-2012-3406: glibc - The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2....
vendor_debian·2012·CVSS 5.0
CVE-2012-3406 [MEDIUM] CVE-2012-3406: glibc - The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2....
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
Scope: local
bookworm: resolved (fixed in 2.19-14)
bullseye: resolved (fixed in 2.19-14)
forky: resolved (fixed in 2.19-14)
sid: resolved (fixed in 2.19-14)
trixie: resolved (fixed in 2.19-14)
Debian
CVE-2012-3404: glibc - The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka g...
vendor_debian·2012·CVSS 5.0
CVE-2012-3404 [MEDIUM] CVE-2012-3404: glibc - The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka g...
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.
Scope: local
bookworm: resolved (fixed in 2.13-35)
bullseye: resolved (fixed in 2.13-35)
forky: resolved (fixed in 2.13-35)
sid: resolved (fixed in 2.13-35)
trixie: resolved (fixed in 2.13-35)
Debian
CVE-2012-3405: glibc - The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka g...
vendor_debian·2012·CVSS 5.0
CVE-2012-3405 [MEDIUM] CVE-2012-3405: glibc - The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka g...
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.
Scope: local
bookworm: resolved (fixed in 2.13-35)
bullseye: resolved (fixed in 2.13-35)
forky: resolved (fixed in 2.13-35)
sid: resolved (fixed in 2.13-35)
trixie: resolved (fixed in 2.13-35)
GHSA
GHSA-8mj9-m673-h2gf: The vfprintf function in stdio-common/vfprintf
ghsa_unreviewed·2022-05-14·CVSS 5.0
CVE-2012-3406 [MEDIUM] GHSA-8mj9-m673-h2gf: The vfprintf function in stdio-common/vfprintf
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
GHSA
GHSA-gm92-3frh-vrww: The vfprintf function in stdio-common/vfprintf
ghsa_unreviewed·2022-05-14
CVE-2012-3404 [MEDIUM] GHSA-gm92-3frh-vrww: The vfprintf function in stdio-common/vfprintf
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.
GHSA
GHSA-fwxh-prpx-6qg8: The vfprintf function in stdio-common/vfprintf
ghsa_unreviewed·2022-05-14·CVSS 5.0
CVE-2012-3405 [MEDIUM] GHSA-fwxh-prpx-6qg8: The vfprintf function in stdio-common/vfprintf
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.
OSV
CVE-2012-3404: The vfprintf function in stdio-common/vfprintf
osv·2014-02-10·CVSS 5.0
CVE-2012-3404 [MEDIUM] CVE-2012-3404: The vfprintf function in stdio-common/vfprintf
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.
OSV
CVE-2012-3405: The vfprintf function in stdio-common/vfprintf
osv·2014-02-10·CVSS 5.0
CVE-2012-3405 [MEDIUM] CVE-2012-3405: The vfprintf function in stdio-common/vfprintf
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.
OSV
CVE-2012-3406: The vfprintf function in stdio-common/vfprintf
osv·2014-02-10·CVSS 5.0
CVE-2012-3406 [MEDIUM] CVE-2012-3406: The vfprintf function in stdio-common/vfprintf
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2012-1098.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1200.htmlhttp://www.openwall.com/lists/oss-security/2012/07/11/17http://www.ubuntu.com/usn/USN-1589-1https://bugzilla.redhat.com/show_bug.cgi?id=833703https://security.gentoo.org/glsa/201503-04https://sourceware.org/bugzilla/show_bug.cgi?id=12445http://rhn.redhat.com/errata/RHSA-2012-1098.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1200.htmlhttp://www.openwall.com/lists/oss-security/2012/07/11/17http://www.ubuntu.com/usn/USN-1589-1https://bugzilla.redhat.com/show_bug.cgi?id=833703https://security.gentoo.org/glsa/201503-04https://sourceware.org/bugzilla/show_bug.cgi?id=12445
2014-02-10
Published