CVE-2010-4051

medium · 5

The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow."

CVSS

40.0%

EPSS (exploit prob.)

99th

EPSS percentile

2011-01-13

Published

AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

Vendor	Product	Affected versions
gnu	glibc	1.00
gnu	glibc	1.01
gnu	glibc	1.02
gnu	glibc	1.03
gnu	glibc	1.04
gnu	glibc	1.05
gnu	glibc	1.06
gnu	glibc	1.07
gnu	glibc	1.08
gnu	glibc	1.09
gnu	glibc	1.09.1
gnu	glibc	2.1
gnu	glibc	2.1.1
gnu	glibc	2.1.1.6
gnu	glibc	2.1.2
gnu	glibc	2.1.3
gnu	glibc	2.1.3.10
gnu	glibc	2.1.9
gnu	glibc	2.10
gnu	glibc	2.10.1
gnu	glibc	2.10.2
gnu	glibc	2.11
gnu	glibc	2.11.1
gnu	glibc	2.11.2
gnu	glibc	2.11.3
gnu	glibc	2.12.0
gnu	glibc	2.12.1
gnu	glibc	2.12.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2010-4051