PT-2012-4175 · Hoard · Hoard

Xi Wang · Published 2012-07-25 · Updated 2012-07-30 · CVE-2012-2676

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hoard versions prior to 3.9

Description The issue is related to multiple integer overflows in the malloc and calloc functions, which can be exploited by context-dependent attackers to perform memory-related attacks, such as buffer overflows, by providing a large size value. This causes less memory to be allocated than expected, potentially leading to security issues in implementing code.

Recommendations For versions prior to 3.9, update to version 3.9 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2012-2676

Affected Products

Hoard

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-2676 · Security Note
• https://github.com/emeryberger/Hoard/blob/master/NEWS · Note
• http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited · Note
• http://openwall.com/lists/oss-security/2012/06/05/1 · Note
• http://openwall.com/lists/oss-security/2012/06/07/13 · Note