SB2014082902 - Multiple vulnerabilities in Glibc

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014082902

SB2014082902 - Multiple vulnerabilities in Glibc

Published: August 29, 2014 Updated: June 3, 2025

Security Bulletin ID SB2014082902
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 67% Medium 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2014-5119)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.


2) Unchecked Return Value (CVE-ID: CVE-1999-0199)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.


3) Unchecked Return Value (CVE-ID: CVE-1999-0199)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.


Remediation

Install update from vendor's website.

References