PT-2009-1084 · Gnu · Gnu Mpfr

Pinar Yanardag · Publicado 2009-03-03 · Atualizado 2009-05-13 · CVE-2009-0757

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU MPFR version 2.4.0 GNU MPFR versions prior to 2.4.1

Description The issue concerns buffer overflows in the mpfr snprintf and mpfr vsnprintf functions, which can be exploited by context-dependent attackers to cause a denial of service, resulting in a crash. The vulnerability can also lead to violations of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely.

Recommendations For GNU MPFR version 2.4.0, update to version 2.4.1 or later to resolve the issue. For GNU MPFR versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue. As a temporary workaround, consider disabling the use of the mpfr snprintf and mpfr vsnprintf functions until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2015-09385

CVE-2009-0757

Produtos afetados

Gnu Mpfr

Referências · 9

• http://securityfocus.com/bid/33945 · Nota
• https://bdu.fstec.ru/vul/2015-09385 · Nota de Segurança
• http://ubuntu.com/usn/USN-772-1 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200903-13.xml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0757 · Nota de Segurança
• http://openwall.com/lists/oss-security/2009/03/02/4 · Correção
• http://secunia.com/advisories/34204 · Nota
• http://secunia.com/advisories/35028 · Nota
• http://mpfr.loria.fr/mpfr-2.4.1 · Aviso do Fabricante