CVE-2014-4043

Publication date 13 June 2014

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

Status

Package Ubuntu Release Status
eglibc 14.04 LTS trusty
Fixed 2.19-0ubuntu6.1
13.10 saucy Ignored end of life
12.04 LTS precise
Fixed 2.15-0ubuntu10.6
10.04 LTS lucid
Fixed 2.11.1-0ubuntu7.14
glibc 14.04 LTS trusty Not in release
13.10 saucy Not in release
12.04 LTS precise Not in release
10.04 LTS lucid Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
eglibc

References

Related Ubuntu Security Notices (USN)

    • USN-2306-1
    • GNU C Library vulnerabilities
    • 4 August 2014

Other references