CVE-2012-5667: Buffer Overflow
An integer overflow leading to a heap-based buffer overflow was found in the way grep, A utility used to search through textual input for lines which contain a match to a specified pattern, parsed large lines of data. This flaw could use used to crash grep or potentially execute arbitrary code, if a local user was tricked into running grep on a specially crafted data file.
Patch: http://git.savannah.gnu.org/cgit/grep.git/commit/?id=cbbc1a45b9f843c811905c97c90a5d31f8e6c189 Reference: http://seclists.org/oss-sec/2012/q4/504
Other sources
Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5667?
CVE-2012-5667 has a severity rating that suggests it can lead to a heap-based buffer overflow, potentially allowing for arbitrary code execution.
How do I fix CVE-2012-5667?
To mitigate CVE-2012-5667, users should upgrade to grep version 2.11 or later.
Which versions of grep are affected by CVE-2012-5667?
Grep versions prior to 2.11, including but not limited to versions 2.2 through 2.10, are impacted by CVE-2012-5667.
What impact does CVE-2012-5667 have on system security?
CVE-2012-5667 can cause grep to crash and may permit the execution of arbitrary code, posing a significant security risk.
Is it safe to use grep versions before 2.11 due to CVE-2012-5667?
It is not safe to use grep versions prior to 2.11 as they are vulnerable to exploitation via CVE-2012-5667.