Back to feed
EUVD-2009-5109 · Published Feb 26, 2019
In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.
Technologies
Netapp Steelstore Cloud Integrated StorageGnu GlibcNetapp Ontap Select Deploy Administration UtilityNetapp Cloud Backup
Weaknesses
CWE-19
CVSS scores
- v3.07.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - v2.05.0
AV:N/AC:L/Au:N/C:N/I:N/A:P
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238
- https://sourceware.org/bugzilla/show_bug.cgi?id=11053
- https://sourceware.org/bugzilla/show_bug.cgi?id=18986
- http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793
Potentially impacted assets
See if this affects your attack surface
