PT-2009-1120 · Gnu+3 · Glibc+3

Padma81 · Published 2009-12-04 · Updated 2024-06-15 · CVE-2009-5155

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions glibc versions prior to 2.28

Description The issue is related to the parse reg exp function in the GNU C Library, which misparses alternatives. This can allow attackers to cause a denial of service, resulting in an assertion failure and application exit, or trigger an incorrect result by attempting a regular-expression match. The vulnerability is associated with data processing errors.

Recommendations For versions prior to 2.28, update to version 2.28 or later to resolve the issue. As a temporary workaround, consider restricting the use of regular expressions in affected applications until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-19

Related Identifiers

ALT-PU-2019-3114

AZL-44574

AZL-44787

BDU:2021-05821

CVE-2009-5155

OPENSUSE-SU-2024:10792-1

SUSE-SU-2019:1102-1

SUSE-SU-2019:1877-1

SUSE-SU-2019:1958-1

SUSE-SU-2019:1958-2

SUSE-SU-2019_1102-1

SUSE-SU-2019_1877-1

SUSE-SU-2019_1958-1

SUSE-SU-2019_1958-2

USN-4954-1

Affected Products

Alt Linux

Suse

Ubuntu

Glibc

References · 82

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=11053 · Exploit
• 🔥 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806 · Exploit
• 🔥 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=18986 · Exploit
• http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2009-5155 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-5155 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:1958-2 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-5155 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44574 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05821 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-5155 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44787 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4954-1 · Vendor Advisory