PT-2016-3450 · Gnu+4 · Glibc+4

Florian Weimer · Publicado 2016-04-28 · Atualizado 2024-06-15 · CVE-2016-10739

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions glibc versions through 2.28

Description The issue is related to insufficient input validation in the getaddrinfo function of the GNU C Library. This could allow an attacker to access confidential data, compromise data integrity, and cause a denial of service. The getaddrinfo function can parse a string containing an IPv4 address followed by whitespace and arbitrary characters, potentially leading applications to incorrectly assume a valid string has been parsed.

Recommendations For versions through 2.28, consider updating to a version where this issue is fixed, as the current version allows for potential exploitation due to the lack of proper input validation in the getaddrinfo function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2019-3114

BDU:2023-07719

CESA-2019_2118

CESA-2019_3513

CVE-2016-10739

OPENSUSE-SU-2019:1250-1

OPENSUSE-SU-2019_1250-1

OPENSUSE-SU-2024:10792-1

RHSA-2019:2118

RHSA-2019:3513

RHSA-2019_2118

RHSA-2019_3513

SUSE-SU-2019:0903-1

SUSE-SU-2019:1102-1

SUSE-SU-2023:0015-1

SUSE-SU-2023_0015-1

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Glibc

Referências · 116

• https://suse.com/security/cve/CVE-2016-10739.html · Nota
• https://suse.com/security/cve/CVE-2009-5155 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10739 · Aviso do Fabricante
• https://t.me/cvenotify/5650 · Publicação no Telegram
• https://bugzilla.suse.com/1127223 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-10739 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2019/suse-su-20191102-1 · Nota
• https://sourceware.org/bugzilla/show_bug.cgi?id=20018 · Correção
• https://ubuntu.com/security/CVE-2016-10739 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2021-05821 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2019:3513 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-15670 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2019-August/018776.html · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2019:1250-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2023:0015-1 · Aviso do Fabricante