Buffer Overflow Affecting glibc package, versions [,2.29)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.07% (34th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-GLIBC-3021180
  • published11 Sept 2022
  • disclosed11 Sept 2022
  • creditUnknown

Introduced: 11 Sep 2022

CVE-2021-40647  (opens in a new tab)
CWE-119  (opens in a new tab)
CWE-120  (opens in a new tab)

How to fix?

Upgrade glibc to version 2.29 or higher.

Overview

Affected versions of this package are vulnerable to Buffer Overflow when a specific string is read in from a file and is overwriting the size parameter in the top chunk of the heap. This at least causes the program to segmentation abort if the heap size parameter isn't aligned correctly.

CVSS Base Scores

version 3.1