Published: 31/01/2024 Updated: 16/02/2024

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 0

A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu glibc
fedoraproject fedora 38
fedoraproject fedora 39

DescriptionA heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library This function is called by the syslog and vsyslog functions This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 b ...

Qualys discovered a memory corruption in the glibc's qsort() function, due to a missing bounds check To be vulnerable, a program must call qsort() with a nontransitive comparison function (a function cmp(int a, int b) that returns (a - b), for example) and with a large number of attacker-controlled elements (to cause a malloc() failure inside qsor ...

Qualys discovered a heap-based buffer overflow in the GNU C Library's __vsyslog_internal() function, which is called by both syslog() and vsyslog() This vulnerability was introduced in glibc 237 (in August 2022) ...

oss-sec mailing list archives   By Date By Thread </form>    Out-of-bounds read & write in the glibc's qsort()   From: Qualys Secu ...

oss-sec mailing list archives   By Date By Thread </form>    CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()   From: ...

ele spawns elevated processes.

ele ele spawns elevated processes To make this work, there are two pieces: ele ele is a command line application You can call it the way you might expect: $ ele id uid=0(root) gid=0(root) groups=0(root) At least for non-interactive applications For applications that need access to the terminal (like a shell), use -i: $ ele --interactive

SBF likely off the hook for misplaced FTX funds after cops bust SIM swap ring

The Register

Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources PLUS: more glibc vulns discovered; DraftKings hacker sentenced; and a hefty dose of critical vulnerabilities

Infosec In Brief The recent indictment of a massive SIM-swapping ring may mean convicted crypto conman Sam Bankman-Fried is innocent of at least one allegation still hanging over his head: The theft of more than $400 million in crypto hacked from wallets belonging to his crypto firm, FTX, just before it declared bankruptcy. As reported earlier this week, a trio of individuals, led by Chicago resident Robert Powell, were indicted [PDF] on charges of committing SIM swapping attacks on over 50 vict...

CVE-2023-6246

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Mailing Lists

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect