CVE-2012-3404
Fixed in a distro release EPSS 2%
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.
Products: gnu glibc, redhat enterprise_virtualization, canonical ubuntu_linux, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | glibc | 2.13-35 |
| Debian 13 | glibc | 2.13-35 |
| Debian 14 | glibc | 2.13-35 |
| Red Hat Enterprise Linux 6 | glibc | 0:2.12-1.80.el6_3.3 |
| Red Hat Enterprise Linux 6 | glibc-common | 0:2.12-1.80.el6_3.3 |
| Red Hat Enterprise Linux 6 | glibc-debuginfo | 0:2.12-1.80.el6_3.3 |
| Red Hat Enterprise Linux 6 | glibc-debuginfo-common | 0:2.12-1.80.el6_3.3 |
| Red Hat Enterprise Linux 6 | glibc-devel | 0:2.12-1.80.el6_3.3 |
| Red Hat Enterprise Linux 6 | glibc-headers | 0:2.12-1.80.el6_3.3 |
| Red Hat Enterprise Linux 6 | glibc-static | 0:2.12-1.80.el6_3.3 |
| Red Hat Enterprise Linux 6 | glibc-utils | 0:2.12-1.80.el6_3.3 |
| Red Hat Enterprise Linux 6 | nscd | 0:2.12-1.80.el6_3.3 |
| Red Hat Enterprise Linux 6 | rhev-hypervisor6 | 0:6.3-20120815.0.el6_3 |