Homepage
About Snyk

Resource Management Errors Affecting glibc package, versions <2.7-8

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment

    Threat Intelligence

    EPSS
    1.51% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN11-GLIBC-521729
  • published 17 Mar 2008
  • disclosed 17 Mar 2008
Report a new vulnerability Found a mistake?

Introduced: 17 Mar 2008

CVE-2008-1367 Open this link in a new tab
CWE-399 Open this link in a new tab

How to fix?

Upgrade Debian:11 glibc to version 2.7-8 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signal handling in the Linux kernel, which might allow context-dependent attackers to trigger memory corruption. NOTE: this issue was originally reported for CPU consumption in SBCL.

References

CVSS Scores

version 3.1
Expand this section

NVD

Recommended
7.3 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    Low
  • Availability (A)
    Low