CVE-2019-7309
First published: Sun Feb 03 2019(Updated: )
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU glibc | <=2.29 | |
| <=2.29 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-7309?
CVE-2019-7309 is a vulnerability in the GNU C Library (glibc) that affects versions up to 2.29.
What is the severity of CVE-2019-7309?
The severity of CVE-2019-7309 is medium with a CVSS score of 5.5.
How does CVE-2019-7309 affect the x32 architecture?
CVE-2019-7309 can incorrectly return zero when the memcmp function is used on the x32 architecture.
How can I fix CVE-2019-7309?
To fix CVE-2019-7309, update the GNU C Library (glibc) to version 2.29 or higher.
Where can I find more information about CVE-2019-7309?
You can find more information about CVE-2019-7309 at the following references: [SecurityFocus](http://www.securityfocus.com/bid/106835), [Gentoo GLSA](https://security.gentoo.org/glsa/202006-04), [Sourceware Bugzilla](https://sourceware.org/bugzilla/show_bug.cgi?id=24155).
- collector/nvd-index
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/gnu
- canonical/gnu glibc
- version/gnu glibc/2.29