CVE-2011-1006

Published: Mar 22, 2011Modified: Apr 29, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in the parse_cgroup_spec function in tools/tools-common.c in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 allows local users to gain privileges via a crafted controller list on the command line of an application. NOTE: it is not clear whether this issue crosses privilege boundaries.

Affected (17)

Products: Balbir Singh: Libcgroup

1 product

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Balbir Singh Libcgroup	Up to 0.37
Balbir Singh Libcgroup	Version 0.1b
Balbir Singh Libcgroup	Version 0.1c
Balbir Singh Libcgroup	Version 0.2
Balbir Singh Libcgroup	Version 0.31
Balbir Singh Libcgroup	Version 0.32.1
Balbir Singh Libcgroup	Version 0.32.2
Balbir Singh Libcgroup	Version 0.32
Balbir Singh Libcgroup	Version 0.33
Balbir Singh Libcgroup	Version 0.34
Balbir Singh Libcgroup	Version 0.35.1
Balbir Singh Libcgroup	Version 0.35
Balbir Singh Libcgroup	Version 0.36.1
Balbir Singh Libcgroup	Version 0.36.2
Balbir Singh Libcgroup	Version 0.36
Balbir Singh Libcgroup	Version 0.37 rc1
Balbir Singh Libcgroup	Version 0.3

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (32)

http://libcg.git.sourceforge.net/git/gitweb.cgi?p=libcg/libcg%3Ba=commit%3Bh=5ae8aea1ecd60c439121d3329d8eaabf13d292c1

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056683.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056734.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2011-04/msg00027.html

Source: secalert@redhat.com

http://secunia.com/advisories/43611

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/43758

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/43891

Source: secalert@redhat.com

http://secunia.com/advisories/44093

Source: secalert@redhat.com

http://sourceforge.net/projects/libcg/files/libcgroup/v0.37.1/libcgroup-0.37.1.tar.bz2/download

Source: secalert@redhat.com

Patch

http://www.debian.org/security/2011/dsa-2193

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0320.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/46729

Source: secalert@redhat.com

http://www.securitytracker.com/id?1025158

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0679

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0774

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=678107

Source: secalert@redhat.com

Patch

http://libcg.git.sourceforge.net/git/gitweb.cgi?p=libcg/libcg%3Ba=commit%3Bh=5ae8aea1ecd60c439121d3329d8eaabf13d292c1

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056683.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056734.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2011-04/msg00027.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43611

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/43758

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/43891

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/44093

Source: af854a3a-2127-422b-91ae-364da2661108

http://sourceforge.net/projects/libcg/files/libcgroup/v0.37.1/libcgroup-0.37.1.tar.bz2/download

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.debian.org/security/2011/dsa-2193

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2011-0320.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/46729

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1025158

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0679

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0774

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=678107

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.