eglibc - Stack-based Buffer Overflow in glob Implementation
Summary
DLA-494-1: eglibc - security update. Affects eglibc versions < 2.13-38+deb7u11. Fixed in 2.13-38+deb7u11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eglibc is the Debian GNU C Library, which provides the core C library functions used by most programs on a Debian system. It is responsible for providing low-level functionality such as memory allocation, string manipulation, and input/output operations. The library is widely used and critical for the proper functioning of various applications and services.
Vulnerability Detail
This vulnerability, identified as CVE-2016-1234, affects the glob implementation in eglibc. When the glob function is called with the GLOB_ALTDIRFUNC flag and encounters a long file name, it suffers from a stack-based buffer overflow. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition on a system running a vulnerable version of eglibc.
How To Fix
Minimum fixed version
2.13-38+deb7u11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade eglibcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to ensure the integrity and security of the system.
Conclusion
The stack-based buffer overflow vulnerability in the glob implementation of eglibc (CVE-2016-1234) can be mitigated by upgrading the eglibc package to version 2.13-38+deb7u11 or later. It is crucial to promptly apply the security update to protect the system from potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for eglibc →
FAQ
eglibc is the Debian GNU C Library, which provides the core C library functions used by most programs on a Debian system.
The vulnerability allows an attacker to execute arbitrary code or cause a denial-of-service condition on a system running a vulnerable version of eglibc.
To fix this vulnerability, it is recommended to upgrade the eglibc package to version 2.13-38+deb7u11 or later.
There is no known workaround for this vulnerability. It is essential to apply the security update to ensure the integrity and security of the system.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for eglibc.
