Bug 922243 (CVE-2011-5320) - VUL-0: CVE-2011-5320: glibc,glibc.i686: glibc scanf implementation crashes with long string of zeros
Summary: VUL-0: CVE-2011-5320: glibc,glibc.i686: glibc scanf implementation crashes wi...
Status: RESOLVED DUPLICATE of bug 916222
Alias: CVE-2011-5320
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Andreas Schwab
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/114719/
Whiteboard: CVSSv2:NVD:CVE-2011-5320:2.1:(AV:L/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-13 10:54 UTC by Andreas Stieger
Modified: 2019-05-01 16:41 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-03-13 10:54:20 UTC 
via Ubuntu tracker, originally from http://marc.info/?l=gimp-developer&m=129567990905823&w=2 (Nelson A. de Oliveira)

glibc scanf implementation crashes with long string of zeros

Reproducer:

#include <stdio.h>
int main()
{
    int a;
    scanf("%i", &a);
    return 0;
}

Expected output none; actual output:

$ perl -e 'print "5"x21000000' | ./a.out
Segmentation fault



Commits:
Fix:
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=3f8cc204fdd0
Optimisation?
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=20b38e0



Fixed in glibc, 2.15, meaning SLE 12 not affected.
Checked SLE 11 code, affected code is in.




References:
http://marc.info/?l=gimp-developer&m=129567990905823&w=2
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-5320
http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-5320.html
Comment 1 Marcus Meissner 2015-03-13 17:06:58 UTC 
same as bug https://www.suse.com/show_bug.cgi?id=920341 , but has a CVE now
Comment 2 Swamp Workflow Management 2015-03-13 23:01:09 UTC 
bugbot adjusting priority
Comment 3 Andreas Stieger 2015-03-20 17:02:12 UTC 
dup

*** This bug has been marked as a duplicate of bug 916222 ***