Summary
Ein lokaler Angreifer kann mehrere Schwachstellen in GNU libc ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service Zustand herbeizuführen.
Product
Die GNU libc ist die Basis C Bibliothek unter Linux sowie anderen Unix-Betriebssystemen, welche die Systemaufrufe sowie Basisfunktionalität bereitstellt.
Vulnerabilities 3
-
High 8.4CVE-2023-6246 Public exploit
Glibc: heap-based buffer overflow in __vsyslog_internal()
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to N…
-
High 8.2
Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()
An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes…
-
Medium 5.3
Glibc: integer overflow in __vsyslog_internal()
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation…
Revision history
-
#7
Neue Updates von Dell aufgenommen
-
#6
Neue Updates von Dell aufgenommen
-
#5
Neue Updates von Dell aufgenommen
-
#4
Neue Updates von Siemens aufgenommen
-
#3
Neue Updates von Dell aufgenommen
-
#2
Neue Updates von Gentoo und Ubuntu aufgenommen
-
#1
Initiale Fassung
References
-
glibc advisory announcement vom 2024-01-30
https://sourceware.org/pipermail/libc-announce/2024/000037.html
-
Qualys Blog vom 2024-01-30
https://blog.qualys.com/vulnerabilities-threat-research/2024/01/30/qualys-tru-discovers-important-vulnerabilities-in-gnu-c-librarys-syslog
-
Qualys Security Advisory mit PoC vom 2024-01-30
https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
-
Fedora Security Advisory vom 2024-01-30
https://bodhi.fedoraproject.org/updates/FEDORA-2024-07597a0fb3
-
Fedora Security Advisory vom 2024-01-30
https://bodhi.fedoraproject.org/updates/FEDORA-2024-aec80d6e8a
-
Debian Security Advisory vom 2024-01-30
https://lists.debian.org/debian-security-announce/2024/msg00018.html
-
glibc advisory announcement vom 2024-01-30
https://sourceware.org/pipermail/libc-announce/2024/000037.html
-
Gentoo Linux Security Advisory GLSA-202402-01 vom 2024-02-02
https://security.gentoo.org/glsa/202402-01
-
Ubuntu Security Notice USN-6620-1 vom 2024-02-01
https://ubuntu.com/security/notices/USN-6620-1
-
Dell Security Advisory DSA-2025-146 vom 2025-04-08
https://www.dell.com/support/kbdoc/en-us/000299628/dsa-2025-146-security-update-for-dell-idrac9-vulnerabilities
-
Siemens Security Advisory SSA-082556 vom 2025-06-10
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
-
Dell Security Advisory DSA-2025-339 vom 2025-09-01
https://www.dell.com/support/kbdoc/de-de/000362542/dsa-2025-339-security-update-for-dell-avamar-data-store-gen5a-multiple-third-party-component-vulnerabilities
-
Dell Security Advisory DSA-2025-166 vom 2025-10-14
https://www.dell.com/support/kbdoc/de-de/000363693/dsa-2025-166-security-update-for-dell-powerscale-onefs-multiple-third-party-component-vulnerabilities
-
Dell Security Advisory DSA-2026-401 vom 2026-09-16
https://www.dell.com/support/kbdoc/de-de/000509706/dsa-2026-401-security-update-for-dell-ecs-and-objectscale-multiple-third-party-component-vulnerabilities