CVE-2013-4357

Published: Dec 31, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service.

Affected (9)

Products: Eglibc: Eglibc · Novell: Suse Linux Enterprise Server · Debian: Debian Linux · +2 more

Show all products

Eglibc: Eglibc · Novell: Suse Linux Enterprise Server · Debian: Debian Linux · Canonical: Ubuntu Linux · Fedoraproject: Fedora

Eglibc

1 product

Eglibc

Novell

1 product

Suse Linux Enterprise Server

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eglibc Eglibc	Before 2.14

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Novell Suse Linux Enterprise Server	Version 11.0 sp2

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 6.0
Debian Debian Linux	Version 7.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 18
Fedoraproject Fedora	Version 19

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (30)

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00020.html

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2013/09/17/4

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2013/09/17/8

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2015/01/28/18

Source: secalert@redhat.com

ExploitMailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2015/01/29/21

Source: secalert@redhat.com

ExploitMailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2015/02/24/3

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/67992

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2306-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2306-2

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2306-3

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/security/cve/cve-2013-4357

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4357

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-4357

Source: secalert@redhat.com

ExploitIssue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/95103

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://security-tracker.debian.org/tracker/CVE-2013-4357

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00020.html