CVE-2023-25139
published 2023-02-03CVE-2023-25139: sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to…
PriorityP347critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.42%
70.1th percentile
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | — | — |
| gnu | glibc | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
glibc: incorrect printf output for integers with thousands separator and width field
vendor_redhat·2023-02-03·CVSS 9.8
CVE-2023-25139 [CRITICAL] CWE-787 glibc: incorrect printf output for integers with thousands separator and width field
glibc: incorrect printf output for integers with thousands separator and width field
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
A vulnerability was found in glibc. When the printf family of functions is called with a format specifier that uses an apostrophe (enable grouping) and a minimum width specifier, the resulting output could be larger than reasonably expected by a
Debian
CVE-2023-25139: glibc - sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds w...
vendor_debian·2023·CVSS 9.8
CVE-2023-25139 [CRITICAL] CVE-2023-25139: glibc - sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds w...
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
OSV
CVE-2023-25139: sprintf in the GNU C Library (glibc) 2
osv·2023-02-03·CVSS 9.8
CVE-2023-25139 [CRITICAL] CVE-2023-25139: sprintf in the GNU C Library (glibc) 2
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
GHSA
GHSA-2g67-jw5m-244m: sprintf in the GNU C Library (glibc) 2
ghsa_unreviewed·2023-02-03
CVE-2023-25139 [CRITICAL] CWE-787 GHSA-2g67-jw5m-244m: sprintf in the GNU C Library (glibc) 2
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2023/02/10/1https://security.netapp.com/advisory/ntap-20230302-0010/https://sourceware.org/bugzilla/show_bug.cgi?id=30068http://www.openwall.com/lists/oss-security/2023/02/10/1https://security.netapp.com/advisory/ntap-20230302-0010/https://sourceware.org/bugzilla/show_bug.cgi?id=30068
2023-02-03
Published