CVE-2012-3480

Publication date 25 August 2012

Last updated 26 May 2025

Description

Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related functions" in stdlib in GNU C Library (aka glibc or libc6) 2.16 allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
eglibc	12.04 LTS precise	Fixed in 2.15-0ubuntu10.2
	11.10 oneiric	Fixed in 2.13-20ubuntu5.2
	11.04 natty	Fixed in 2.13-0ubuntu13.2
	10.04 LTS lucid	Fixed in 2.11.1-0ubuntu7.11
	8.04 LTS hardy	Not in release
glibc	12.04 LTS precise	Not in release
	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Fixed in 2.7-10ubuntu8.2

Notes

jdstrand

stack-protector should prevent code execution

References

Related Ubuntu Security Notices (USN)

USN-1589-2
GNU C Library regression
17 December 2012

USN-1589-1
GNU C Library vulnerabilities
2 October 2012

Other references

https://www.cve.org/CVERecord?id=CVE-2012-3480