ALT-PU-2021-2137-1

Package update glibc in branch sisyphus

Version2.32-alt3

Published2021-07-03

Max severityCRITICAL

Severity:

Closed issues (2)

CRITICAL9.8

Уязвимость системной библиотеки GNU C Library (glibc), связанная с использованием памяти после ее освобождения, позволяющая нарушителю выполнить отказ в обслуживании

Published: 2021-12-28Modified: 2022-11-21

CVSS 3.xCRITICAL 9.8

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0CRITICAL 10.0

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

References

CVE-2021-33574

CRITICAL9.8

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Published: 2021-05-25Modified: 2024-11-21

CVSS 2.0HIGH 7.5

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References