| Vulnerability Name: | CVE-2019-1010025 (CCN-163702) | ||||||||||||||||||||
| Assigned: | 2018-02-28 | ||||||||||||||||||||
| Published: | 2018-02-28 | ||||||||||||||||||||
| Updated: | 2020-11-16 | ||||||||||||||||||||
| Summary: | ** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. Note: the vendor's position is "ASLR bypass itself is not a vulnerability." | ||||||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) 4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:R)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:R)
| ||||||||||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||||||||||||||
| Vulnerability Type: | CWE-330 | ||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2019-1010025 Source: XF Type: UNKNOWN gnulibc-cve20191010025-sec-bypass(163702) Source: DEBIAN Type: UNKNOWN CVE-2019-1010025 Source: CCN Type: Sourceware Bugzilla - Bug 22853 Heap address of pthread_create thread is aligned Source: MISC Type: Exploit, Issue Tracking, Third Party Advisory https://sourceware.org/bugzilla/show_bug.cgi?id=22853 Source: CONFIRM Type: UNKNOWN https://support.f5.com/csp/article/K06046097 Source: CONFIRM Type: UNKNOWN https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS Source: UBUNTU Type: UNKNOWN CVE-2019-1010025 Source: CCN Type: GNU Web site The GNU C Library (glibc) | ||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||