PT-2020-7012 · Gnu · Glibc

Published 2020-10-06 · Updated 2020-12-03 · CVE-1999-0199

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions glibc versions prior to 2.2

Description The issue is related to the manual/search.texi in the GNU C Library, where a lack of documentation about the return value of the tdelete function when deleting a tree's root might allow attackers to access a dangling pointer. This could potentially be exploited in applications where the developer was not aware of a documentation update from 1999.

Recommendations For versions prior to 2.2, update to version 2.2 or later to resolve the issue.

Exploit

Fix

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

CVE-1999-0199

Affected Products

Glibc

References · 7

• 🔥 https://cee.studio/tdelete.html · Exploit
• https://github.com/bminor/glibc/commit/2864e767053317538feafa815046fff89e5a16be#diff-94e8c502f255fdfc346df0e29fd4ef40 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-1999-0199 · Security Note
• https://ftp.gnu.org/gnu/glibc/glibc-2.2.tar.gz · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-1999-0199 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-1999-0199 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-1999-0199 · Vendor Advisory