MESSAGE
| DATE | 2019-03-03 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [Hangout - NYLXS] glibc vulnerabilty
|
CVE-2009-5155 Detail
Current Description
In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in
posix/regcomp.c misparses alternatives, which allows attackers to cause
a denial of service (assertion failure and application exit) or trigger
an incorrect result by attempting a regular-expression match.
Source: MITRE
Description Last Modified: 02/25/2019
View Analysis Description
Impact
CVSS v3.0 Severity and Metrics:
Base Score: 7.5 HIGH
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (V3 legend)
Impact Score: 3.6
Exploitability Score: 3.9
Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): None
Availability (A): High
CVSS v2.0 Severity and Metrics:
Base Score: 5.0 MEDIUM
Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) (V2 legend)
Impact Subscore: 2.9
Exploitability Subscore: 10.0
Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (AU): None
Confidentiality (C): None
Integrity (I): None
Availability (A): Partial
Additional Information:
Allows disruption of service
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have
provided these links to other web sites because they may have
information that would be of interest to you. No inferences should be
drawn on account of other sites being referenced, or not, from this
page. There may be other web sites that are more appropriate for your
purpose. NIST does not necessarily endorse the views expressed, or
concur with the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on these sites.
Please address comments about this page to nvd-at-nist.gov.
--
So many immigrant groups have swept through our town
that Brooklyn, like Atlantis, reaches mythological
proportions in the mind of the world - RI Safir 1998
http://www.mrbrklyn.com
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002
http://www.nylxs.com - Leadership Development in Free Software
http://www2.mrbrklyn.com/resources - Unpublished Archive
http://www.coinhangout.com - coins!
http://www.brooklyn-living.com
Being so tracked is for FARM ANIMALS and and extermination camps,
but incompatible with living as a free human being. -RI Safir 2013
_______________________________________________
Hangout mailing list
Hangout-at-nylxs.com
http://lists.mrbrklyn.com/mailman/listinfo/hangout
|
|
