CVE-2015-1473

Publication date 5 February 2015

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.

Read the notes from the security team

Status

Package Ubuntu Release Status
eglibc 14.10 utopic Not in release
14.04 LTS trusty
Fixed 2.19-0ubuntu6.6
12.04 LTS precise
Fixed 2.15-0ubuntu10.11
10.04 LTS lucid
Not affected
glibc 14.10 utopic
Fixed 2.19-10ubuntu2.3
14.04 LTS trusty Not in release
12.04 LTS precise Not in release
10.04 LTS lucid Not in release

Notes

tyhicks

Note that the upstream bug #16618 contains the issue of CVE-2015-1472 *and* this CVE

mdeslaur

fixed in same commit as CVE-2015-1472

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
glibc

References

Related Ubuntu Security Notices (USN)

    • USN-2519-1
    • GNU C Library vulnerabilities
    • 26 February 2015

Other references