PT-2012-1255 · Google · Gperftools

Publicado 2012-07-25 · Atualizado 2012-08-09 · CVE-2005-4895

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions gperftools versions prior to 0.4

Description The issue is related to multiple integer overflows in TCMalloc (tcmalloc.cc) that can be exploited by context-dependent attackers to perform memory-related attacks, such as buffer overflows. This occurs when a large size value is provided, resulting in less memory being allocated than expected.

Recommendations For versions prior to 0.4, update to version 0.4 or later to resolve the issue. As a temporary workaround, consider restricting the input size values to prevent large values from being processed by the vulnerable TCMalloc function.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2005-4895

Produtos afetados

Gperftools

Referências · 6

• https://security-tracker.debian.org/tracker/CVE-2005-4895 · Aviso do Fabricante
• http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited · Nota
• https://osv.dev/vulnerability/CVE-2005-4895 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-4895 · Nota de Segurança
• http://code.google.com/p/gperftools/source/browse/tags/perftools-0.4/ChangeLog · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-4895 · Aviso do Fabricante