CVE-2009-4881

glibc < 2.10.1 - Denial of Service via __vstrfmon_l Integer Overflow

Title source: llm
STIX 2.1

Description

Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.

References (6)

Core 6
Core References
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:111
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201011-01.xml
Various Sources x_refsource_confirm
http://sources.redhat.com/bugzilla/show_bug.cgi?id=10600
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/59241
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2010/dsa-2058

Scores

EPSS 0.0060
EPSS Percentile 69.8%

Details

CWE
CWE-189
Status published
Products (46)
gnu/glibc 1.00
gnu/glibc 1.01
gnu/glibc 1.02
gnu/glibc 1.03
gnu/glibc 1.04
gnu/glibc 1.05
gnu/glibc 1.06
gnu/glibc 1.07
gnu/glibc 1.08
gnu/glibc 1.09
... and 36 more
Published Jun 01, 2010
Tracked Since Feb 18, 2026