medium
5
CWE
Advisory Published
CVE Published
Updated

CVE-2010-4051

First published: Fri Oct 22 2010(Updated: )

Maksymilian Arciemowicz reported a deficiency in the way glibc regular expression engine processed certain patterns. A local attacker could use this flaw to cause a denial of service (crash due stack overflow). Note: The above described behavior is a limitation of glibc regular expression engine. Regular expression matching function is called recursively for certain types of patterns (where subexpression using quantifier is nested inside of another quantified expression), where long input can result in deep recursion and exhaustion of all stack memory (i.e. impact is limited to crash). Amount of stack memory available to glibc regular expression engine influences the size of input that must be provided to trigger the crash. Alternatively, expression can be modified to avoid quantification nesting, or program modified to limit size of input passed to regular expression engine. Conclusion: Due the above described behavior Red Hat Security Response Team would not classify this deficiency to be a security issue. References: [1] <a href="http://www.kb.cert.org/vuls/id/912279">http://www.kb.cert.org/vuls/id/912279</a> [2] <a href="http://www.securityfocus.com/archive/1/515589">http://www.securityfocus.com/archive/1/515589</a> [3] <a href="http://forums.cnet.com/7726-6132_102-5042238.html">http://forums.cnet.com/7726-6132_102-5042238.html</a> [4] <a href="http://secunia.com/advisories/42547/">http://secunia.com/advisories/42547/</a> [5] <a href="http://securityreason.com/securityalert/8003">http://securityreason.com/securityalert/8003</a>

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
GNU C Library=2.1.2
GNU C Library=2.11
GNU C Library=2.10.1
GNU C Library=1.00
GNU C Library=1.06
GNU C Library=2.1.1
GNU C Library=1.02
GNU C Library=1.07
GNU C Library=2.12.0
GNU C Library=2.1.1.6
GNU C Library=1.04
GNU C Library=1.01
GNU C Library=2.1
GNU C Library=1.09.1
GNU C Library=2.1.9
GNU C Library=2.12.1
GNU C Library=1.09
GNU C Library=2.10
GNU C Library=2.11.2
GNU C Library=1.03
GNU C Library=2.1.3.10
GNU C Library=2.11.3
GNU C Library=1.08
GNU C Library=2.11.1
GNU C Library=2.1.3
GNU C Library=1.05
GNU C Library=2.12.2
GNU C Library=2.10.2
GNU C Library (glibc)=1.00
GNU C Library (glibc)=1.01
GNU C Library (glibc)=1.02
GNU C Library (glibc)=1.03
GNU C Library (glibc)=1.04
GNU C Library (glibc)=1.05
GNU C Library (glibc)=1.06
GNU C Library (glibc)=1.07
GNU C Library (glibc)=1.08
GNU C Library (glibc)=1.09
GNU C Library (glibc)=1.09.1
GNU C Library (glibc)=2.1
GNU C Library (glibc)=2.1.1
GNU C Library (glibc)=2.1.1.6
GNU C Library (glibc)=2.1.2
GNU C Library (glibc)=2.1.3
GNU C Library (glibc)=2.1.3.10
GNU C Library (glibc)=2.1.9
GNU C Library (glibc)=2.10
GNU C Library (glibc)=2.10.1
GNU C Library (glibc)=2.10.2
GNU C Library (glibc)=2.11
GNU C Library (glibc)=2.11.1
GNU C Library (glibc)=2.11.2
GNU C Library (glibc)=2.11.3
GNU C Library (glibc)=2.12.0
GNU C Library (glibc)=2.12.1
GNU C Library (glibc)=2.12.2

Remedy

http://cxib.net/stuff/proftpd.gnu.c

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2010-4051?

    CVE-2010-4051 has a severity rating that indicates it can lead to denial of service through a stack overflow.

  • How do I fix CVE-2010-4051?

    To fix CVE-2010-4051, you should update the GNU C Library (glibc) to a version that addresses this vulnerability.

  • What versions of glibc are affected by CVE-2010-4051?

    CVE-2010-4051 affects multiple versions of GNU C Library (glibc) including versions from 1.00 to 2.12.2.

  • What type of attack does CVE-2010-4051 facilitate?

    CVE-2010-4051 facilitates denial of service attacks by causing a crash due to stack overflow.

  • Who reported the CVE-2010-4051 vulnerability?

    The CVE-2010-4051 vulnerability was reported by Maksymilian Arciemowicz.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203