All errata/sisyphus/ALT-PU-2021-2280-1
ALT-PU-2021-2280-1

Package update glibc in branch sisyphus

Version2.32-alt4
Published2021-07-20
Max severityCRITICAL
Severity:

Closed issues (2)

BDU:2021-03561
MEDIUM6.7

Уязвимость функции wordexp() библиотеки, обеспечивающей системные вызовы и основные функции glibc, позволяющая нарушителю читать произвольные файлы

Published: 2021-07-13Modified: 2022-10-20
CVSS 3.xMEDIUM 6.7
CVSS:3.x/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0MEDIUM 5.6
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:N/A:C
References
CVE-2021-35942
CRITICAL9.1

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Published: 2021-07-22Modified: 2026-02-13
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H