In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
En la biblioteca GNU C (también conocida como glibc o libc6), hasta la versión 2.29, proceed_next_node en posix/regexec.c tiene una sobrelectura de búfer basada en memoria dinámica (heap) mediante un intento de coincidencia de expresiones regulares que no distinguen entre mayúsculas y minúsculas.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-125
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnu | glibc | * | <built-in method update of dict object at 0x7fd39c4df800> | Application |
| netapp | cloud_backup | * | <built-in method update of dict object at 0x7fd39c4dd240> | Application |
| netapp | ontap_select_deploy_administration_utility | - | <built-in method update of dict object at 0x7fd3081a4f80> | Application |
| netapp | steelstore_cloud_integrated_storage | - | <built-in method update of dict object at 0x7fd3081a5f80> | Application |
| mcafee | web_gateway | * | <built-in method update of dict object at 0x7fd39c4ddb80> | Application |
| mcafee | web_gateway | * | <built-in method update of dict object at 0x7fd39c4df240> | Application |
| mcafee | web_gateway | * | <built-in method update of dict object at 0x7fd3081a5b00> | Application |
| canonical | ubuntu_linux | 16.04 | <built-in method update of dict object at 0x7fd39c4ddb00> | Operating System |
| canonical | ubuntu_linux | 18.04 | <built-in method update of dict object at 0x7fd37018f200> | Operating System |
| canonical | ubuntu_linux | 19.10 | <built-in method update of dict object at 0x7fd39c4dc880> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:cloud_backup:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* |