Description
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Canonical / Ubuntu Linux16.04 – 16.04
- Canonical / Ubuntu Linux19.10 – 19.10
- Canonical / Ubuntu Linux18.04 – 18.04
- gnu / glibc2.29
- McAfee / Web Gateway7.7.2.0 – 7.7.2.21
- NetApp / cloud_backup
- NetApp / ONTAP Select Deploy administration utility
- NetApp / steelstore_cloud_integrated_storage
References
- MISChttp://www.securityfocus.com/bid/107160
- MISChttps://security.gentoo.org/glsa/202006-04
- VENDOR_ADVISORYhttps://usn.ubuntu.com/4416-1/
- MISChttps://kc.mcafee.com/corporate/index?page=content&id=SB10278
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html
- MISChttps://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9
- MISChttps://security.netapp.com/advisory/ntap-20190315-0002/
- MISChttps://sourceware.org/bugzilla/show_bug.cgi?id=24114
- MISChttps://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142
- MISChttps://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140
- MISChttps://support.f5.com/csp/article/K54823184
Updated 10m ago · 8 sources