CVE-2023-25139
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string.
Risk Assessment
The buffer overflow can lead to memory corruption, application crashes, or potential arbitrary code execution. The risk affects applications using the vulnerable glibc version and formatting numbers with thousands separators.
Recommendation
Update glibc to a version containing the fix for this bug. Until patched, avoid formatting numbers with thousands separators and padding in vulnerable contexts.
Other vulnerabilities in glibc
See all- CVE-2023-6779High
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This issue occurs when the syslog and vsyslog functions are called with a message larger than INT_MAX bytes, leading to an incorrect buffer size calculation and application crash.
- CVE-2015-5180High
The res_query function in libresolv in glibc before version 2.25 has a vulnerability that allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to process crashes.
- CVE-2017-1000366High
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, potentially resulting in arbitrary code execution. This affects glibc 2.25 and earlier.
- CVE-2015-5229High
The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.
- CVE-2016-2856High
In glibc versions before 2.19-18+deb8u4 on Debian jessie and before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS, 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS, 2.21-0ubuntu4.2 on Ubuntu 15.10, and 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10, there is a lack of namespace check associated with file-descriptor passing. This allows local users to capture keystrokes and spoof data, potentially gaining privileges.
- CVE-2015-0235High
CVE-2015-0235 involves a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc in versions 2.2 and other 2.x versions before 2.18. This allows attackers to execute arbitrary code via the gethostbyname or gethostbyname2 functions.
- CVE-2014-4043High
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, allowing context-dependent attackers to trigger use-after-free vulnerabilities.
- CVE-2024-33600Medium
In glibc 2.15, a bug was introduced in the nscd daemon that causes a null pointer dereference when a not-found netgroup response is not added to the cache. This leads to a crash of nscd.
- CVE-2022-23219Critical
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (glibc) through 2.34 copies its hostname argument on the stack without validating its length. This may result in a buffer overflow, potentially leading to a denial of service or, if an application is not built with a stack protector enabled, arbitrary code execution.
- CVE-2022-23218Critical
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Original NVD description (English source)
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS