Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

glibc 2.5/2.12 may crash or be hijacked by crafted strings

CVE-2012-3406 · published 12 years ago
Summary

A part of the GNU C Library used for formatting text can be tricked by specially crafted input, causing the program to stop working or potentially run unwanted code. This affects any software that relies on those library versions for text formatting. Update the library to the latest version or apply the vendor's patch to remove the risk.

What to do
  • Update debian glibc to version 2.19-14.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian glibc < 2.19-14
Fix: upgrade to 2.19-14
Debian:13 debian glibc < 2.19-14
Fix: upgrade to 2.19-14
Debian:14 debian glibc < 2.19-14
Fix: upgrade to 2.19-14
– gnu glibc 2.5
2.12
cpe:2.3:a:gnu:glibc:2.5:*:*:*:*:*:*:*
– redhat enterprise_virtualization 3.0
cpe:2.3:a:redhat:enterprise_virtualization:3.0:*:*:*:*:*:*:*
– canonical ubuntu_linux 8.04
10.04
11.04
11.10
12.04
cpe:2.3:o:canonical:ubuntu_linux:8.04:-:lts:*:*:*:*:*
– redhat enterprise_linux 5
6.0
cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
Original advisory text
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the ...
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
References
Severity
6.8 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published10 Feb 2014
Updated31 Oct 2026
First seen5 Sep 2026
Sources
DEBIAN-CVE-2012-3406 · OSV
CVE-2012-3406 · NVD
Track software like this
Free during beta