PT-2012-1259 · Gnu+3 · Libc+3

Publicado 2012-07-25 · Atualizado 2012-07-26 · CVE-2006-7252

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions jemalloc in libc for FreeBSD version 6.4 jemalloc in libc for NetBSD (affected versions not specified)

Description The issue is related to an integer overflow in the calloc function, which can lead to memory-related attacks such as buffer overflows. This occurs when a large size value is provided, resulting in a memory allocation of one byte.

Recommendations For jemalloc in libc for FreeBSD version 6.4: update to a version that fixes the integer overflow issue in the calloc function. For jemalloc in libc for NetBSD: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2006-7252

Produtos afetados

Freebsd

Netbsd

Jemalloc

Libc

Referências · 3

• http://svnweb.freebsd.org/base?view=revision&revision=161263 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-7252 · Nota de Segurança
• http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited · Nota