PT-2012-1255 · Google · Gperftools

Published 2012-07-25 · Updated 2012-08-09 · CVE-2005-4895

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions gperftools versions prior to 0.4

Description The issue is related to multiple integer overflows in TCMalloc (tcmalloc.cc) that can be exploited by context-dependent attackers to perform memory-related attacks, such as buffer overflows. This occurs when a large size value is provided, resulting in less memory being allocated than expected.

Recommendations For versions prior to 0.4, update to version 0.4 or later to resolve the issue. As a temporary workaround, consider restricting the input size values to prevent large values from being processed by the vulnerable TCMalloc function.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2005-4895

Affected Products

Gperftools

References · 6

• https://security-tracker.debian.org/tracker/CVE-2005-4895 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-4895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4895 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-4895 · Vendor Advisory
• http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited · Note
• http://code.google.com/p/gperftools/source/browse/tags/perftools-0.4/ChangeLog · Note