CVE-2012-3405: Medium severity GNU glibc vulnerability
It was discovered that the formatted printing functionality in glibc used extendalloca() incorrectly. A remote attacker could provide a specially crafted sequence of format specifiers, leading to a desynchronization within the buffer size handling, resulting in the use of uninitialized memory or, potentially, FORTIFYSOURCE format string protection mechanism bypass, when processed.
References: http://sourceware.org/bugzilla/showbug.cgi?id=13446 http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=a4647e727a2a52e1259474c13f4b13288938bed4
Other sources
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3405?
CVE-2012-3405 is considered a critical vulnerability due to the potential for memory corruption and exploitation.
How do I fix CVE-2012-3405?
To fix CVE-2012-3405, you should upgrade to a patched version of glibc or the affected software.
What software is affected by CVE-2012-3405?
CVE-2012-3405 affects glibc version 2.14 and specific versions of Red Hat and Ubuntu Linux.
What type of vulnerability is CVE-2012-3405?
CVE-2012-3405 is a memory corruption vulnerability that can be exploited remotely.
Can CVE-2012-3405 be exploited over the network?
Yes, CVE-2012-3405 can be exploited remotely by an attacker leveraging crafted format specifiers.