NetSight
IP …
medium5.0

CVE-2012-3404

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, whic…

Impact

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.

Affected products

VendorProductAffected versions
GnuGlibc
Version 2.12
RedhatEnterprise Virtualization
Version 3.0
CanonicalUbuntu Linux
Versions 8.04, 10.04, 11.04, 11.10, 12.04
RedhatEnterprise Linux
Version 6.0

Weakness classification

CWE-189

References