CVE-2009-4880 Integer overflow in n/a
Integer overflows in glibc's strfmon allow attackers to cause denial of service via crafted format strings, impacting applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-4880?
CVE-2009-4880 is a medium-severity vulnerability in Gnu Glibc, published on 1 Jun 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391.
Weakness: CWE-189
Which versions are affected by CVE-2009-4880?
It affects 1 product.
Products include Gnu Glibc.
How do I fix CVE-2009-4880?
Upgrade to a fixed version.
Is CVE-2009-4880 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-4880 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Gnu Glibc
Sources
Also known as DEBIAN-CVE-2009-4880, GHSA-362p-9mx3-r47m.