Published: 08/04/2011 Updated: 13/02/2023

CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9

VMScore: 515

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

The GNU C Library (aka glibc or libc6) prior to 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent malicious users to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu glibc 2.2.2
gnu glibc 2.9
gnu glibc 2.7
gnu glibc 2.1.2
gnu glibc 2.11
gnu glibc 2.0.5
gnu glibc 2.2.5
gnu glibc 2.0.6
gnu glibc 2.10.1
gnu glibc 1.00
gnu glibc 1.06
gnu glibc 2.1.1
gnu glibc 1.02
gnu glibc 2.0.3
gnu glibc 1.07
gnu glibc 2.3.1
gnu glibc 2.3
gnu glibc 2.12.0
gnu glibc 2.0
gnu glibc 2.1.1.6
gnu glibc 1.04
gnu glibc 1.01
gnu glibc 2.3.10
gnu glibc 2.4
gnu glibc 2.1
gnu glibc 2.3.4
gnu glibc 1.09.1
gnu glibc 2.1.9
gnu glibc
gnu glibc 2.3.3
gnu glibc 2.6.1
gnu glibc 2.0.1
gnu glibc 1.09
gnu glibc 2.10
gnu glibc 2.11.2
gnu glibc 2.5.1
gnu glibc 2.6
gnu glibc 2.0.4
gnu glibc 2.0.2
gnu glibc 2.2.1
gnu glibc 2.3.2
gnu glibc 1.03
gnu glibc 2.1.3.10
gnu glibc 2.3.6
gnu glibc 2.2.3
gnu glibc 2.5
gnu eglibc
gnu glibc 2.11.3
gnu glibc 1.08
gnu glibc 2.3.5
gnu glibc 2.8
gnu glibc 2.11.1
gnu glibc 2.2.4
gnu glibc 2.1.3
gnu glibc 1.05
gnu glibc 2.2
gnu glibc 2.10.2

Synopsis Moderate: glibc security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated glibc packages that fix multiple security issues and one bug arenow available for Red Hat Enterprise Linux 4The Red Hat Security Response Team has rated this update as having moderatesecurity impact ...

Debian Bug report logs - #615120 eglibc: alloca memory corruption Package: eglibc; Maintainer for eglibc is (unknown); Reported by: Michael Gilbert <michaelsgilbert@gmailcom> Date: Fri, 25 Feb 2011 21:21:01 UTC Severity: grave Found in version 2112-10 Fixed in versions eglibc/2112-12, eglibc/2113-1 Done: Aureli ...

Multiple vulnerabilities were discovered and fixed in the GNU C Library ...

/* source: wwwsecurityfocuscom/bid/46563/info GNU glibc is prone to a stack-corruption vulnerability An attacker can exploit this issue to execute arbitrary machine code in the context of the application that uses the affected library Failed exploit attempts will likely crash the application GNU glibc versions prior to 2122 are vul ...

CWE-399 http://openwall.com/lists/oss-security/2011/02/28/15 http://seclists.org/fulldisclosure/2011/Feb/635 http://www.redhat.com/support/errata/RHSA-2011-0412.html http://www.redhat.com/support/errata/RHSA-2011-0413.html http://sourceware.org/bugzilla/show_bug.cgi?id=11883 http://securitytracker.com/id?1025290 http://www.securityfocus.com/bid/46563 http://secunia.com/advisories/43830 http://seclists.org/fulldisclosure/2011/Feb/644 http://openwall.com/lists/oss-security/2011/02/26/3 http://secunia.com/advisories/43492 http://bugs.debian.org/615120 http://openwall.com/lists/oss-security/2011/02/28/11 https://bugzilla.redhat.com/show_bug.cgi?id=681054 http://scarybeastsecurity.blogspot.com/2011/02/i-got-accidental-code-execution-via.html http://code.google.com/p/chromium/issues/detail?id=48733 http://secunia.com/advisories/43989 http://www.vupen.com/english/advisories/2011/0863 http://securityreason.com/securityalert/8175 http://secunia.com/advisories/46397 http://www.vmware.com/security/advisories/VMSA-2011-0012.html http://www.mandriva.com/security/advisories?name=MDVSA-2011:178 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12853 http://www.securityfocus.com/archive/1/520102/100/0/threaded http://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=f15ce4d8dc139523fe0c273580b604b2453acba6 https://access.redhat.com/errata/RHSA-2012:0125 https://usn.ubuntu.com/1396-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/17120/

CVE-2011-1071

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect