7.8

CVE-2017-1000366

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

Data is provided by the National Vulnerability Database (NVD)
Redhat ≫ Enterprise Linux Version5 Editionserver
Redhat ≫ Enterprise Linux Version6.0
Redhat ≫ Enterprise Linux Version7.0
Novell ≫ Suse Linux Enterprise Desktop Version12.0 Updatesp2
Novell ≫ Suse Linux Enterprise Point Of Sale Version11.0 Updatesp3
Novell ≫ Suse Linux Enterprise Server Version11.0 Updatesp3 SwEditionltss
Opensuse ≫ Leap Version42.2
Suse ≫ Linux Enterprise For Sap Version12 Updatesp1
Suse ≫ Linux Enterprise Server Version10 Updatesp4 SwEditionltss
Suse ≫ Linux Enterprise Server Version11 Updatesp4
Suse ≫ Linux Enterprise Server Version12 Updatesp1 SwEditionltss
Suse ≫ Linux Enterprise Server Version12 Updatesp2
Suse ≫ Linux Enterprise Server Version12 Updatesp2 SwEditionltss
Gnu ≫ Glibc Version <= 2.25
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Mcafee ≫ Web Gateway Version <= 7.6.2.14
Mcafee ≫ Web Gateway Version >= 7.7.0.0 <= 7.7.2.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 7.81% 0.916
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
Third Party Advisory
Technical Description
http://www.securityfocus.com/bid/99127
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038712
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/42274/
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/42275/
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/42276/
Third Party Advisory
VDB Entry