CVE-2010-4051

描述

The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow."

如何修補 CVE-2010-4051

要修補 CVE-2010-4051,請將受影響套件升級到下列已修補版本。

• Debian/glibc—升級至 2.19-4 或更新版本

CVE-2010-4051 正在被利用嗎?

中等 — EPSS 為 40.0%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 2.19-4

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2010-4051