UBUNTU-CVE-2020-29573

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2020-29573
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-29573.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2020-29573
Related
Published
2020-12-06T00:15:00Z
Modified
2020-12-06T00:15:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.

References

Affected packages

Ubuntu:Pro:14.04:LTS / eglibc

Package

Name
eglibc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.17-93ubuntu4
2.18-0ubuntu1
2.18-0ubuntu2
2.18-0ubuntu4
2.18-0ubuntu5
2.18-0ubuntu6
2.18-0ubuntu7
2.19-0ubuntu2
2.19-0ubuntu3
2.19-0ubuntu4
2.19-0ubuntu5
2.19-0ubuntu6
2.19-0ubuntu6.1
2.19-0ubuntu6.3
2.19-0ubuntu6.4
2.19-0ubuntu6.5
2.19-0ubuntu6.6
2.19-0ubuntu6.7
2.19-0ubuntu6.8
2.19-0ubuntu6.9
2.19-0ubuntu6.10
2.19-0ubuntu6.11
2.19-0ubuntu6.13
2.19-0ubuntu6.14
2.19-0ubuntu6.15
2.19-0ubuntu6.15+esm1
2.19-0ubuntu6.15+esm2
2.19-0ubuntu6.15+esm3

Ecosystem specific 

{
    "ubuntu_priority": "low"
}

Ubuntu:16.04:LTS / glibc

Package

Name
glibc
Purl
pkg:deb/ubuntu/glibc@2.23-0ubuntu11.2?arch=src?distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.23-0ubuntu11.2

Affected versions

2.*

2.21-0ubuntu4
2.21-0ubuntu5
2.21-0ubuntu6
2.23-0ubuntu1
2.23-0ubuntu2
2.23-0ubuntu3
2.23-0ubuntu4
2.23-0ubuntu5
2.23-0ubuntu6
2.23-0ubuntu7
2.23-0ubuntu9
2.23-0ubuntu10
2.23-0ubuntu11

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libc6-s390-dbgsym": "2.23-0ubuntu11.2",
            "libc6-dev": "2.23-0ubuntu11.2",
            "libc6-udeb-dbgsym": "2.23-0ubuntu11.2",
            "multiarch-support": "2.23-0ubuntu11.2",
            "libc6-ppc64": "2.23-0ubuntu11.2",
            "libc6-dev-s390": "2.23-0ubuntu11.2",
            "libc6-dev-i386": "2.23-0ubuntu11.2",
            "locales-all": "2.23-0ubuntu11.2",
            "libc6-amd64-dbgsym": "2.23-0ubuntu11.2",
            "glibc-source": "2.23-0ubuntu11.2",
            "libc6-dev-amd64": "2.23-0ubuntu11.2",
            "libc6-pic": "2.23-0ubuntu11.2",
            "nscd-dbgsym": "2.23-0ubuntu11.2",
            "nscd": "2.23-0ubuntu11.2",
            "glibc-doc": "2.23-0ubuntu11.2",
            "libc6-ppc64-dbgsym": "2.23-0ubuntu11.2",
            "libc6-armel": "2.23-0ubuntu11.2",
            "libc6-dbg": "2.23-0ubuntu11.2",
            "libc6": "2.23-0ubuntu11.2",
            "libc6-armel-dbgsym": "2.23-0ubuntu11.2",
            "libc-bin": "2.23-0ubuntu11.2",
            "libc6-i386": "2.23-0ubuntu11.2",
            "libc6-udeb": "2.23-0ubuntu11.2",
            "libc6-dev-x32": "2.23-0ubuntu11.2",
            "libc-bin-dbgsym": "2.23-0ubuntu11.2",
            "libc-dev-bin": "2.23-0ubuntu11.2",
            "libc6-amd64": "2.23-0ubuntu11.2",
            "libc6-x32": "2.23-0ubuntu11.2",
            "libc6-dbgsym": "2.23-0ubuntu11.2",
            "libc6-s390": "2.23-0ubuntu11.2",
            "libc6-dev-armel": "2.23-0ubuntu11.2",
            "libc6-dev-ppc64": "2.23-0ubuntu11.2",
            "libc6-i386-dbgsym": "2.23-0ubuntu11.2",
            "locales": "2.23-0ubuntu11.2",
            "libc-dev-bin-dbgsym": "2.23-0ubuntu11.2",
            "libc6-x32-dbgsym": "2.23-0ubuntu11.2"
        }
    ]
}

Ubuntu:18.04:LTS / glibc

Package

Name
glibc
Purl
pkg:deb/ubuntu/glibc@2.27-3ubuntu1.4?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.27-3ubuntu1.4

Affected versions

2.*

2.26-0ubuntu2
2.26-0ubuntu2.1
2.27-0ubuntu2
2.27-0ubuntu3
2.27-3ubuntu1
2.27-3ubuntu1.2
2.27-3ubuntu1.3

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libc6-s390-dbgsym": "2.27-3ubuntu1.4",
            "libc6-dev": "2.27-3ubuntu1.4",
            "multiarch-support": "2.27-3ubuntu1.4",
            "libc6-dev-s390": "2.27-3ubuntu1.4",
            "libc6-dev-i386": "2.27-3ubuntu1.4",
            "locales-all": "2.27-3ubuntu1.4",
            "libc6-amd64-dbgsym": "2.27-3ubuntu1.4",
            "libc6-pic": "2.27-3ubuntu1.4",
            "glibc-source": "2.27-3ubuntu1.4",
            "libc6-dev-amd64": "2.27-3ubuntu1.4",
            "nscd-dbgsym": "2.27-3ubuntu1.4",
            "nscd": "2.27-3ubuntu1.4",
            "glibc-doc": "2.27-3ubuntu1.4",
            "libc6-armel": "2.27-3ubuntu1.4",
            "libc6-armel-dbgsym": "2.27-3ubuntu1.4",
            "libc6": "2.27-3ubuntu1.4",
            "libc6-dbg": "2.27-3ubuntu1.4",
            "libc-bin": "2.27-3ubuntu1.4",
            "libc6-i386": "2.27-3ubuntu1.4",
            "libc6-udeb": "2.27-3ubuntu1.4",
            "libc6-dev-x32": "2.27-3ubuntu1.4",
            "libc-bin-dbgsym": "2.27-3ubuntu1.4",
            "libc-dev-bin": "2.27-3ubuntu1.4",
            "libc6-amd64": "2.27-3ubuntu1.4",
            "libc6-x32": "2.27-3ubuntu1.4",
            "libc6-s390": "2.27-3ubuntu1.4",
            "libc6-dev-armel": "2.27-3ubuntu1.4",
            "libc6-i386-dbgsym": "2.27-3ubuntu1.4",
            "locales": "2.27-3ubuntu1.4",
            "libc6-lse": "2.27-3ubuntu1.4",
            "libc-dev-bin-dbgsym": "2.27-3ubuntu1.4",
            "libc6-x32-dbgsym": "2.27-3ubuntu1.4"
        }
    ]
}

Ubuntu:20.04:LTS / glibc

Package

Name
glibc
Purl
pkg:deb/ubuntu/glibc@2.31-0ubuntu9.1?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.31-0ubuntu9.1

Affected versions

2.*

2.30-0ubuntu2
2.30-0ubuntu3
2.31-0ubuntu5
2.31-0ubuntu6
2.31-0ubuntu7
2.31-0ubuntu9

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libc6-s390-dbgsym": "2.31-0ubuntu9.1",
            "libc6-dev": "2.31-0ubuntu9.1",
            "libc6-dev-s390": "2.31-0ubuntu9.1",
            "libc6-dev-i386": "2.31-0ubuntu9.1",
            "locales-all": "2.31-0ubuntu9.1",
            "libc6-amd64-dbgsym": "2.31-0ubuntu9.1",
            "libc6-pic": "2.31-0ubuntu9.1",
            "glibc-source": "2.31-0ubuntu9.1",
            "libc6-dev-amd64": "2.31-0ubuntu9.1",
            "nscd-dbgsym": "2.31-0ubuntu9.1",
            "nscd": "2.31-0ubuntu9.1",
            "glibc-doc": "2.31-0ubuntu9.1",
            "libc6-armel": "2.31-0ubuntu9.1",
            "libc6-armel-dbgsym": "2.31-0ubuntu9.1",
            "libc6": "2.31-0ubuntu9.1",
            "libc6-dbg": "2.31-0ubuntu9.1",
            "libc-bin": "2.31-0ubuntu9.1",
            "libc6-i386": "2.31-0ubuntu9.1",
            "libc6-udeb": "2.31-0ubuntu9.1",
            "libc6-dev-x32": "2.31-0ubuntu9.1",
            "libc-bin-dbgsym": "2.31-0ubuntu9.1",
            "libc-dev-bin": "2.31-0ubuntu9.1",
            "libc6-amd64": "2.31-0ubuntu9.1",
            "libc6-x32": "2.31-0ubuntu9.1",
            "libc6-s390": "2.31-0ubuntu9.1",
            "libc6-dev-armel": "2.31-0ubuntu9.1",
            "libc6-i386-dbgsym": "2.31-0ubuntu9.1",
            "locales": "2.31-0ubuntu9.1",
            "libc6-lse": "2.31-0ubuntu9.1",
            "libc-dev-bin-dbgsym": "2.31-0ubuntu9.1",
            "libc6-x32-dbgsym": "2.31-0ubuntu9.1"
        }
    ]
}