Vulnerability Details : CVE-2009-4881
Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.
Vulnerability category: OverflowDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2009-4881
Probability of exploitation activity in the next 30 days: 0.56%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 75 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2009-4881
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2009-4881
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-4881
-
http://www.debian.org/security/2010/dsa-2058
Debian -- Security Information -- DSA-2058-1 glibc, eglibc
-
http://www.mandriva.com/security/advisories?name=MDVSA-2010:111
mandriva.com
-
http://security.gentoo.org/glsa/glsa-201011-01.xml
GNU C library: Multiple vulnerabilities (GLSA 201011-01) — Gentoo security
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/59241
-
http://sourceware.org/git/?p=glibc.git;a=commit;h=153aa31b93be22e01b236375fb02a9f9b9a0195f
Patch
- http://sources.redhat.com/bugzilla/show_bug.cgi?id=10600
Products affected by CVE-2009-4881
- cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.1.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.3:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.1.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.4:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.6:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.8:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:2.7:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.04:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.03:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.09:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.08:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.07:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.00:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.02:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.01:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.06:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:glibc:1.05:*:*:*:*:*:*:*