CVE-2019-9169

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an att… (CVE-2019-9169)

Description

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

Source: CVELISTV5 NVD

Metrics

Severity

critical

103.76

—

no public PoC known

9.8

Source: nvd-v3

CVSS v3

9.8

CVSS v4

—

EPSS percentile

91.3 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

4.7 %

Moderate — model estimates 1-10% exploitation likelihood.

Published

2019-02-26 02:00 UTC

CWE

—

Affected operating systems

linux
canonical / ubuntu_linux16.04
linux
canonical / ubuntu_linux18.04
linux
canonical / ubuntu_linux19.10

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

gnu
glibc2.29
mcafee
web_gateway7.7.2.0 – 7.7.2.21
mcafee
web_gateway7.8.2.0 – 7.8.2.8
mcafee
web_gateway8.0.0 – 8.1.1
netapp
cloud_backup
netapp
ontap_select_deploy_administration_utility
netapp
steelstore_cloud_integrated_storage

References & sources

IDCVE-2019-9169