Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name MDVSA-2012:158 First vendor Publication 2012-10-03
Vendor Mandriva Last vendor Modification 2012-10-03
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue was identified and fixed in gc:

Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc funtions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected (CVE-2012-2673).

The updated packages have been patched to correct this issue.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2012:158

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-189 Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18032
 
Oval ID: oval:org.mitre.oval:def:18032
Title: USN-1546-1 -- libgc vulnerability
Description: Applications using libgc could be made to crash or run arbitrary programs as your login.
Family: unix Class: patch
Reference(s): USN-1546-1
CVE-2012-2673
 Version: 5
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.04
Ubuntu 8.04
 Product(s): libgc
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21261
 
Oval ID: oval:org.mitre.oval:def:21261
Title: RHSA-2013:1500: gc security update (Moderate)
Description: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc funtions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Family: unix Class: patch
Reference(s): RHSA-2013:1500-00
CESA-2013:1500
CVE-2012-2673
 Version: 4
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): gc
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24185
 
Oval ID: oval:org.mitre.oval:def:24185
Title: ELSA-2013:1500: gc security update (Moderate)
Description: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc funtions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Family: unix Class: patch
Reference(s): ELSA-2013:1500-00
CVE-2012-2673
 Version: 6
Platform(s): Oracle Linux 6
 Product(s): gc
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27305
 
Oval ID: oval:org.mitre.oval:def:27305
Title: DEPRECATED: ELSA-2013-1500 -- gc security update (moderate)
Description: [7.1-12] - Fix host triplets on x86 (#1014273) - Related: CVE-2012-2673 [7.1-11] - Add sanity checking for calloc/malloc calls - Resolves: CVE-2012-2673
Family: unix Class: patch
Reference(s): ELSA-2013-1500
CVE-2012-2673
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): gc
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 94

OpenVAS Exploits

Date Description
2012-10-05 Name : Mandriva Update for gc MDVSA-2012:158 (gc)
File : nvt/gb_mandriva_MDVSA_2012_158.nasl
2012-09-06 Name : Ubuntu Update for libgc USN-1546-1
File : nvt/gb_ubuntu_USN_1546_1.nasl
2012-08-30 Name : Fedora Update for gc FEDORA-2012-9556
File : nvt/gb_fedora_2012_9556_gc_fc17.nasl
2012-06-28 Name : Fedora Update for gc FEDORA-2012-9637
File : nvt/gb_fedora_2012_9637_gc_fc16.nasl

Nessus® Vulnerability Scanner

Date Description
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2014-0149.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2014-0150.nasl - Type : ACT_GATHER_INFO
2013-11-14 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-245.nasl - Type : ACT_GATHER_INFO
2013-11-05 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1500.nasl - Type : ACT_GATHER_INFO
2013-11-05 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1500.nasl - Type : ACT_GATHER_INFO
2013-11-05 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1500.nasl - Type : ACT_GATHER_INFO
2013-11-05 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131104_gc_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-10-04 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-158.nasl - Type : ACT_GATHER_INFO
2012-08-29 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1546-1.nasl - Type : ACT_GATHER_INFO
2012-06-28 Name : The remote Fedora host is missing a security update.
File : fedora_2012-9556.nasl - Type : ACT_GATHER_INFO
2012-06-28 Name : The remote Fedora host is missing a security update.
File : fedora_2012-9637.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:43:11
  • Multiple Updates