Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-4788

The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.

Published

2013-10-04T17:55:09.960

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

4.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application gnu glibc ≤ 2.17 Yes
Application gnu glibc 2.0 Yes
Application gnu glibc 2.0.1 Yes
Application gnu glibc 2.0.2 Yes
Application gnu glibc 2.0.3 Yes
Application gnu glibc 2.0.4 Yes
Application gnu glibc 2.0.5 Yes
Application gnu glibc 2.0.6 Yes
Application gnu glibc 2.1 Yes
Application gnu glibc 2.1.1 Yes
Application gnu glibc 2.1.1.6 Yes
Application gnu glibc 2.1.2 Yes
Application gnu glibc 2.1.3 Yes
Application gnu glibc 2.1.9 Yes
Application gnu glibc 2.4 Yes
Application gnu glibc 2.10.1 Yes
Application gnu glibc 2.11 Yes
Application gnu glibc 2.11.1 Yes
Application gnu glibc 2.11.2 Yes
Application gnu glibc 2.11.3 Yes
Application gnu glibc 2.12.1 Yes
Application gnu glibc 2.12.2 Yes
Application gnu glibc 2.13 Yes
Application gnu glibc 2.14 Yes
Application gnu glibc 2.14.1 Yes
Application gnu glibc 2.15 Yes
Application gnu glibc 2.16 Yes
Application gnu eglibc * Yes
References