- Description
- Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.
- Source
- cve@mitre.org
- NVD status
- Deferred
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- nvd@nist.gov
- CWE-189
- Hype score
- Not currently trending
- Red HatRed Hat does not consider this to be a security issue. Properly written application should not use arbitrary untrusted data as part of the format string passed to functions as strfmon or printf family functions.
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:freebsd:freebsd:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D2C79D5-D27F-4B08-A8DF-3E3AAF4E16A5"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:6.0:release:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CCE4F2E6-2286-4D87-ADD7-7E999B4E5620"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:6.0:stable:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C07C3BEF-8D6A-4F23-96DE-AFE4369D08EF"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:6.0_p5_release:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67FDB43C-84D1-4B45-BFB9-340F3687A22F"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47E0A416-733A-4616-AE08-150D67FCEA70"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:7.0:pre-release:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42231BCC-2B90-4196-A1C2-408A353C1BEF"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:7.0_beta4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F06B831E-D8F2-4380-B279-559CE103210F"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:7.0_releng:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3ACC9072-4A33-4F1F-B790-2F9D5A52F71B"
},
{
"criteria": "cpe:2.3:o:netbsd:netbsd:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9875E709-11BA-4B8F-A2FC-26844DD4D563"
}
],
"operator": "OR"
}
]
}
]