CVE-2005-3590 Memory corruption in n/a
A buffer overflow in glibc's getgrouplist function allows attackers to corrupt memory and potentially execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-3590?
CVE-2005-3590 is a critical memory corruption vulnerability in Gnu Glibc, published on 10 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory.
Weakness: CWE-119
Which versions are affected by CVE-2005-3590?
It affects 1 product.
Products include Gnu Glibc.
How do I fix CVE-2005-3590?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2005-3590 being exploited?
There is no known exploitation of CVE-2005-3590 in the wild and no public exploit code.
Other vulnerabilities in Gnu Glibc
Sources
Also known as DEBIAN-CVE-2005-3590, GHSA-xhm3-9gcc-42h6.