Vulnerability CVE-2015-8779


Published: 2016-04-19   Modified: 2017-06-30

Description:
Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
glibc catopen() Multiple unbounded stack allocations
CXSECURITY
22.01.2016

Vendor: Debian
Product: Debian linux 
Version: 8.0;
Vendor: Fedoraproject
Product: Fedora 
Version: 23;
Vendor: GNU
Product: Glibc 
Version: 2.22;
Vendor: Canonical
Product: Ubuntu linux 
Version:
15.10
14.04
12.04
Vendor: Novell
Product: Opensuse 
Version: 13.2;
Vendor: SUSE
Product: Linux enterprise desktop 
Version: 12; 11.0;
Product: Linux enterprise server 
Version: 12; 11.0;
Product: Linux enterprise software development kit 
Version: 12; 11.0;
Product: Linux enterprise debuginfo 
Version: 11.0;

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html
http://www.debian.org/security/2016/dsa-3480
http://www.debian.org/security/2016/dsa-3481
http://www.openwall.com/lists/oss-security/2016/01/19/11
http://www.openwall.com/lists/oss-security/2016/01/20/1
http://www.securityfocus.com/bid/82244
http://www.ubuntu.com/usn/USN-2985-1
http://www.ubuntu.com/usn/USN-2985-2
https://security.gentoo.org/glsa/201602-02
https://security.gentoo.org/glsa/201702-11
https://sourceware.org/bugzilla/show_bug.cgi?id=17905
https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html

Related CVE
CVE-2015-5219
The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
CVE-2015-5300
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option,...
CVE-2015-5194
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
CVE-2017-1000366
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made t...
CVE-2016-4473
/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.
CVE-2017-7995
Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project...
CVE-2016-9959
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
CVE-2016-9957
Stack-based buffer overflow in game-music-emu before 0.6.1.

Copyright 2017, cxsecurity.com