[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <54EEE796.7010201@redhat.com>
Date: Thu, 26 Feb 2015 10:29:58 +0100
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com,
Assign a CVE Identifier <cve-assign@...re.org>
Subject: CVE request: glibc scanf implementation crashes on certain inputs
This bug
https://sourceware.org/bugzilla/show_bug.cgi?id=13138
causes scanf and related functions to crash when processing certain
inputs. This happens with the numeric conversions (%d, %f and others),
and includes valid numbers (ISO C allows crashes or worse on invalid
inputs, but glibc is buggy even by this standard).
The first glibc version which received the fix for this bug is 2.15.
The bug was reported in 2011, so it should receive a CVE-2011-XXXX name.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
