CVE-2015-1472
HighSummary
The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (glibc or libc6) before version 2.21 does not properly consider data-type size during memory allocation, which may lead to buffer overflow or other unspecified impacts.
Risk Assessment
Attackers may exploit this vulnerability to cause a denial of service, potentially affecting the availability of applications using this library.
Recommendation
It is recommended to update the glibc library to version 2.21 or later to mitigate this vulnerability.
Other vulnerabilities in GNU C Library (glibc or libc6)
See all- CVE-2015-8982High
Integer overflow in the strxfrm function in the GNU C Library (glibc or libc6) before version 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, leading to a stack-based buffer overflow.
- CVE-2014-9984Critical
nscd in the GNU C Library (glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.
- CVE-2015-8778Critical
Integer overflow in the GNU C Library (glibc or libc6) before version 2.23 allows context-dependent attackers to cause application crashes or potentially execute arbitrary code via the size argument to the __hcreate_r function, leading to out-of-bounds heap-memory access.
Original NVD description (English source)
The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call.