Vulnerability-Lookup

BDU:2021-05821 (CVE-2009-5155)

Vulnerability from fstec – Published: 2021-12-07 – Updated: 2023-11-13 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость функции parse_reg_exp библиотеки glibc, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость функции parse_reg_exp библиотеки glibc связана с ошибками обработки данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Functionality abuse, Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-19 - Обработка данных

Aliases

CVE-2009-5155

References

14 references

URL
https://sourceware.org/bugzilla/show_bug.cgi?id=11053
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793
https://sourceware.org/bugzilla/show_bug.cgi?id=18986
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192…
http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341…
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238
https://ubuntu.com/security/CVE-2009-5155
https://ubuntu.com/security/notices/USN-4954-1
https://access.redhat.com/security/cve/cve-2009-5155
https://support.f5.com/csp/article/K64119434
https://security-tracker.debian.org/tracker/CVE-2009-5155
https://www.suse.com/security/cve/CVE-2009-5155.html
https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81

Impacted products

24 products from 8 vendors

Vendors

Red Hat, Inc., Сообщество свободного программного обеспечения, Novell Inc., ООО «РусБИТех-Астра», F5 Networks, Canonical Ltd., The GNU Project

Products

Red Hat Enterprise Linux, Debian GNU/Linux, Suse Linux Enterprise Desktop, SUSE Linux Enterprise Software Development Kit, Suse Linux Enterprise Server, OpenSUSE Leap, Astra Linux Special Edition для «Эльбрус» (запись в едином реестре российских программ №11156), BIG-IQ Centralized Management, Ubuntu, BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP DNS, BIG-IP Fraud Protection Service, BIG-IP Global Traffic Manager, BIG-IP Link Controller, BIG-IP Policy Enforcement Manager, glibc, BIG-IP LTM, BIG-IP Edge Gateway, BIG-IP Webaccelerator, Traffix SDC

Versions

5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 9 (Debian GNU/Linux), 12 SP4 (Suse Linux Enterprise Desktop), 12 SP4 (SUSE Linux Enterprise Software Development Kit), 12 SP4 (Suse Linux Enterprise Server), 15.0 (OpenSUSE Leap), 12 SP2-BCL (Suse Linux Enterprise Server), 12 SP2-ESPOS (Suse Linux Enterprise Server), 12 SP2-LTSS (Suse Linux Enterprise Server), 12 SP3-LTSS (Suse Linux Enterprise Server), 12 SP3-BCL (Suse Linux Enterprise Server), 12 SP5 (Suse Linux Enterprise Server), 12 SP5 (SUSE Linux Enterprise Software Development Kit), 10 (Debian GNU/Linux), 12 SP3-ESPOS (Suse Linux Enterprise Server), 8.1 «Ленинград» (Astra Linux Special Edition для «Эльбрус»), от 6.0.0 до 6.1.0 (BIG-IQ Centralized Management), 16.04 ESM (Ubuntu), 11 (Debian GNU/Linux), от 16.0.0 до 16.1.0 (BIG-IP Access Policy Manager), от 16.0.0 до 16.1.0 (BIG-IP Advanced Firewall Manager), от 16.0.0 до 16.1.0 (BIG-IP Analytics), от 16.0.0 до 16.1.0 (BIG-IP Application Acceleration Manager), от 16.0.0 до 16.1.0 (BIG-IP Application Security Manager), от 16.0.0 до 16.1.0 (BIG-IP DNS), от 16.0.0 до 16.1.0 (BIG-IP Fraud Protection Service), от 16.0.0 до 16.1.0 (BIG-IP Global Traffic Manager), от 16.0.0 до 16.1.0 (BIG-IP Link Controller), от 16.0.0 до 16.1.0 (BIG-IP Policy Enforcement Manager), до 2.28 (glibc), от 16.0.0 до 16.1.0 (BIG-IP LTM), от 15.0.0 до 15.1.3 (BIG-IP LTM), от 14.0.0 до 14.1.4 (BIG-IP LTM), от 13.0.0 до 13.1.4 (BIG-IP LTM), от 12.1.0 до 12.1.6 (BIG-IP LTM), от 11.5.1 до 11.6.5 (BIG-IP LTM), от 15.0.0 до 15.1.3 (BIG-IP Application Acceleration Manager), от 14.0.0 до 14.1.4 (BIG-IP Application Acceleration Manager), от 13.0.0 до 13.1.4 (BIG-IP Application Acceleration Manager), от 12.1.0 до 12.1.6 (BIG-IP Application Acceleration Manager), от 11.5.1 до 11.6.5 (BIG-IP Application Acceleration Manager), от 15.0.0 до 15.1.3 (BIG-IP Advanced Firewall Manager), от 14.0.0 до 14.1.4 (BIG-IP Advanced Firewall Manager), от 13.0.0 до 13.1.4 (BIG-IP Advanced Firewall Manager), от 12.1.0 до 12.1.6 (BIG-IP Advanced Firewall Manager), от 11.5.1 до 11.6.5 (BIG-IP Advanced Firewall Manager), от 15.0.0 до 15.1.3 (BIG-IP Analytics), от 14.0.0 до 14.1.4 (BIG-IP Analytics), от 13.0.0 до 13.1.4 (BIG-IP Analytics), от 12.1.0 до 12.1.6 (BIG-IP Analytics), от 11.5.1 до 11.6.5 (BIG-IP Analytics), от 15.0.0 до 15.1.3 (BIG-IP Access Policy Manager), от 14.0.0 до 14.1.4 (BIG-IP Access Policy Manager), от 13.0.0 до 13.1.4 (BIG-IP Access Policy Manager), от 12.1.0 до 12.1.6 (BIG-IP Access Policy Manager), от 11.5.1 до 11.6.5 (BIG-IP Access Policy Manager), от 15.0.0 до 15.1.3 (BIG-IP Application Security Manager), от 14.0.0 до 14.1.4 (BIG-IP Application Security Manager), от 13.0.0 до 13.1.4 (BIG-IP Application Security Manager), от 12.1.0 до 12.1.6 (BIG-IP Application Security Manager), от 11.5.1 до 11.6.5 (BIG-IP Application Security Manager), от 15.0.0 до 15.1.3 (BIG-IP DNS), от 14.0.0 до 14.1.4 (BIG-IP DNS), от 13.0.0 до 13.1.4 (BIG-IP DNS), от 12.1.0 до 12.1.6 (BIG-IP DNS), от 11.5.1 до 11.6.5 (BIG-IP DNS), от 16.0.0 до 16.1.0 (BIG-IP Edge Gateway), от 15.0.0 до 15.1.3 (BIG-IP Edge Gateway), от 14.0.0 до 14.1.4 (BIG-IP Edge Gateway), от 13.0.0 до 13.1.4 (BIG-IP Edge Gateway), от 12.1.0 до 12.1.6 (BIG-IP Edge Gateway), от 11.5.1 до 11.6.5 (BIG-IP Edge Gateway), от 15.0.0 до 15.1.3 (BIG-IP Fraud Protection Service), от 14.0.0 до 14.1.4 (BIG-IP Fraud Protection Service), от 13.0.0 до 13.1.4 (BIG-IP Fraud Protection Service), от 12.1.0 до 12.1.6 (BIG-IP Fraud Protection Service), от 11.5.1 до 11.6.5 (BIG-IP Fraud Protection Service), от 15.0.0 до 15.1.3 (BIG-IP Global Traffic Manager), от 14.0.0 до 14.1.4 (BIG-IP Global Traffic Manager), от 13.0.0 до 13.1.4 (BIG-IP Global Traffic Manager), от 12.1.0 до 12.1.6 (BIG-IP Global Traffic Manager), от 11.5.1 до 11.6.5 (BIG-IP Global Traffic Manager), от 15.0.0 до 15.1.3 (BIG-IP Link Controller), от 14.0.0 до 14.1.4 (BIG-IP Link Controller), от 13.0.0 до 13.1.4 (BIG-IP Link Controller), от 12.1.0 до 12.1.6 (BIG-IP Link Controller), от 11.5.1 до 11.6.5 (BIG-IP Link Controller), от 15.0.0 до 15.1.3 (BIG-IP Policy Enforcement Manager), от 14.0.0 до 14.1.4 (BIG-IP Policy Enforcement Manager), от 13.0.0 до 13.1.4 (BIG-IP Policy Enforcement Manager), от 12.1.0 до 12.1.6 (BIG-IP Policy Enforcement Manager), от 11.5.1 до 11.6.5 (BIG-IP Policy Enforcement Manager), от 16.0.0 до 16.1.0 (BIG-IP Webaccelerator), от 15.0.0 до 15.1.3 (BIG-IP Webaccelerator), от 14.0.0 до 14.1.4 (BIG-IP Webaccelerator), от 13.0.0 до 13.1.4 (BIG-IP Webaccelerator), от 12.1.0 до 12.1.6 (BIG-IP Webaccelerator), от 11.5.1 до 11.6.5 (BIG-IP Webaccelerator), от 8.0.0 до 8.1.0 (BIG-IQ Centralized Management), от 7.0.0 до 7.1.0 (BIG-IQ Centralized Management), от 5.0.0 до 5.4.0 (BIG-IQ Centralized Management), от 5.0.0 до 5.1.0 (Traffix SDC), 4.4.0 (Traffix SDC)

Product types

Operating system, Application software, Security device, Security software, Network appliance software, Network device, ПО программно-аппаратных средств защиты, Network software

Platforms

Red Hat, Inc. Red Hat Enterprise Linux 5, Inc. Red Hat Enterprise Linux 6, Inc. Red Hat Enterprise Linux 7, Сообщество свободного программного обеспечения Debian GNU/Linux 9, Novell Inc. Suse Linux Enterprise Desktop 12 SP4, Novell Inc. Suse Linux Enterprise Server 12 SP4, Novell Inc. OpenSUSE Leap 15.0, Novell Inc. Suse Linux Enterprise Server 12 SP2-BCL, Novell Inc. Suse Linux Enterprise Server 12 SP2-ESPOS, Novell Inc. Suse Linux Enterprise Server 12 SP2-LTSS, Novell Inc. Suse Linux Enterprise Server 12 SP3-LTSS, Novell Inc. Suse Linux Enterprise Server 12 SP3-BCL, Novell Inc. Suse Linux Enterprise Server 12 SP5, Сообщество свободного программного обеспечения Debian GNU/Linux 10, Novell Inc. Suse Linux Enterprise Server 12 SP3-ESPOS, ООО «РусБИТех-Астра» Astra Linux Special Edition для «Эльбрус» 8.1 «Ленинград» (запись в едином реестре российских программ №11156), Canonical Ltd. Ubuntu 16.04 ESM, Сообщество свободного программного обеспечения Debian GNU/Linux 11

Mitigations

Использование рекомендаций: Для glibc: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793 https://sourceware.org/bugzilla/show_bug.cgi?id=18986 https://sourceware.org/bugzilla/show_bug.cgi?id=11053 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672 http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238 Для Ubuntu: https://ubuntu.com/security/CVE-2009-5155 https://ubuntu.com/security/notices/USN-4954-1 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2009-5155 Для программных продуктов F5 Networks, Inc.: https://support.f5.com/csp/article/K64119434 Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2009-5155 Для программных продуктов Novell Inc.: https://www.suse.com/security/cve/CVE-2009-5155.html Для Astra Linux Special Edition для «Эльбрус» 8.1 «Ленинград»: обновить пакет glibc до 2.29-26.018-astra1 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, Novell Inc., \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, F5 Networks, Inc., Canonical Ltd., The GNU Project",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "5 (Red Hat Enterprise Linux), 6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 9 (Debian GNU/Linux), 12 SP4 (Suse Linux Enterprise Desktop), 12 SP4 (SUSE Linux Enterprise Software Development Kit), 12 SP4 (Suse Linux Enterprise Server), 15.0 (OpenSUSE Leap), 12 SP2-BCL (Suse Linux Enterprise Server), 12 SP2-ESPOS (Suse Linux Enterprise Server), 12 SP2-LTSS (Suse Linux Enterprise Server), 12 SP3-LTSS (Suse Linux Enterprise Server), 12 SP3-BCL (Suse Linux Enterprise Server), 12 SP5 (Suse Linux Enterprise Server), 12 SP5 (SUSE Linux Enterprise Software Development Kit), 10 (Debian GNU/Linux), 12 SP3-ESPOS (Suse Linux Enterprise Server), 8.1 \u00ab\u041b\u0435\u043d\u0438\u043d\u0433\u0440\u0430\u0434\u00bb (Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb), \u043e\u0442 6.0.0 \u0434\u043e 6.1.0 (BIG-IQ Centralized Management), 16.04 ESM (Ubuntu), 11 (Debian GNU/Linux), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Access Policy Manager), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Advanced Firewall Manager), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Analytics), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Application Acceleration Manager), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Application Security Manager), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP DNS), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Fraud Protection Service), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Global Traffic Manager), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Link Controller), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Policy Enforcement Manager), \u0434\u043e 2.28 (glibc), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP LTM), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP LTM), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP LTM), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP LTM), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP LTM), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP LTM), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Application Acceleration Manager), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Application Acceleration Manager), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Application Acceleration Manager), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Application Acceleration Manager), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Application Acceleration Manager), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Advanced Firewall Manager), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Advanced Firewall Manager), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Advanced Firewall Manager), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Advanced Firewall Manager), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Advanced Firewall Manager), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Analytics), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Analytics), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Analytics), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Analytics), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Analytics), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Access Policy Manager), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Access Policy Manager), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Access Policy Manager), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Access Policy Manager), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Access Policy Manager), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Application Security Manager), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Application Security Manager), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Application Security Manager), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Application Security Manager), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Application Security Manager), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP DNS), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP DNS), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP DNS), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP DNS), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP DNS), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Edge Gateway), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Edge Gateway), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Edge Gateway), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Edge Gateway), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Edge Gateway), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Edge Gateway), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Fraud Protection Service), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Fraud Protection Service), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Fraud Protection Service), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Fraud Protection Service), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Fraud Protection Service), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Global Traffic Manager), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Global Traffic Manager), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Global Traffic Manager), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Global Traffic Manager), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Global Traffic Manager), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Link Controller), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Link Controller), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Link Controller), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Link Controller), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Link Controller), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Policy Enforcement Manager), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Policy Enforcement Manager), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Policy Enforcement Manager), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Policy Enforcement Manager), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Policy Enforcement Manager), \u043e\u0442 16.0.0 \u0434\u043e 16.1.0 (BIG-IP Webaccelerator), \u043e\u0442 15.0.0 \u0434\u043e 15.1.3 (BIG-IP Webaccelerator), \u043e\u0442 14.0.0 \u0434\u043e 14.1.4 (BIG-IP Webaccelerator), \u043e\u0442 13.0.0 \u0434\u043e 13.1.4 (BIG-IP Webaccelerator), \u043e\u0442 12.1.0 \u0434\u043e 12.1.6 (BIG-IP Webaccelerator), \u043e\u0442 11.5.1 \u0434\u043e 11.6.5 (BIG-IP Webaccelerator), \u043e\u0442 8.0.0 \u0434\u043e 8.1.0 (BIG-IQ Centralized Management), \u043e\u0442 7.0.0 \u0434\u043e 7.1.0 (BIG-IQ Centralized Management), \u043e\u0442 5.0.0 \u0434\u043e 5.4.0 (BIG-IQ Centralized Management), \u043e\u0442 5.0.0 \u0434\u043e 5.1.0 (Traffix SDC), 4.4.0 (Traffix SDC)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\n\u0414\u043b\u044f glibc:\nhttps://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793\nhttps://sourceware.org/bugzilla/show_bug.cgi?id=18986\nhttps://sourceware.org/bugzilla/show_bug.cgi?id=11053\nhttps://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672\nhttp://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272\nhttps://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806\nhttps://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2009-5155\nhttps://ubuntu.com/security/notices/USN-4954-1\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2009-5155\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 F5 Networks, Inc.:\nhttps://support.f5.com/csp/article/K64119434\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2009-5155\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://www.suse.com/security/cve/CVE-2009-5155.html\n\n\u0414\u043b\u044f Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb 8.1 \u00ab\u041b\u0435\u043d\u0438\u043d\u0433\u0440\u0430\u0434\u00bb:\n\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 glibc \u0434\u043e 2.29-26.018-astra1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "04.12.2009",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "13.11.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "07.12.2021",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2021-05821",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2009-5155",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Debian GNU/Linux, Suse Linux Enterprise Desktop, SUSE Linux Enterprise Software Development Kit, Suse Linux Enterprise Server, OpenSUSE Leap, Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211611156), BIG-IQ Centralized Management, Ubuntu, BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP DNS, BIG-IP Fraud Protection Service, BIG-IP Global Traffic Manager, BIG-IP Link Controller, BIG-IP Policy Enforcement Manager, glibc, BIG-IP LTM, BIG-IP Edge Gateway, BIG-IP Webaccelerator, Traffix SDC",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 5 , Red Hat, Inc. Red Hat Enterprise Linux 6 , Red Hat, Inc. Red Hat Enterprise Linux 7 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 9 , Novell Inc. Suse Linux Enterprise Desktop 12 SP4 , Novell Inc. Suse Linux Enterprise Server 12 SP4 , Novell Inc. OpenSUSE Leap 15.0 , Novell Inc. Suse Linux Enterprise Server 12 SP2-BCL , Novell Inc. Suse Linux Enterprise Server 12 SP2-ESPOS , Novell Inc. Suse Linux Enterprise Server 12 SP2-LTSS , Novell Inc. Suse Linux Enterprise Server 12 SP3-LTSS , Novell Inc. Suse Linux Enterprise Server 12 SP3-BCL , Novell Inc. Suse Linux Enterprise Server 12 SP5 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , Novell Inc. Suse Linux Enterprise Server 12 SP3-ESPOS , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb 8.1 \u00ab\u041b\u0435\u043d\u0438\u043d\u0433\u0440\u0430\u0434\u00bb  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211611156), Canonical Ltd. Ubuntu 16.04 ESM , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 parse_reg_exp \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 glibc, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-19)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 parse_reg_exp \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 glibc \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u043e\u043c, \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://sourceware.org/bugzilla/show_bug.cgi?id=11053\nhttps://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793\nhttps://sourceware.org/bugzilla/show_bug.cgi?id=18986\nhttps://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672\nhttp://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272\nhttps://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806\nhttps://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238\nhttps://ubuntu.com/security/CVE-2009-5155\nhttps://ubuntu.com/security/notices/USN-4954-1\nhttps://access.redhat.com/security/cve/cve-2009-5155\nhttps://support.f5.com/csp/article/K64119434\nhttps://security-tracker.debian.org/tracker/CVE-2009-5155\nhttps://www.suse.com/security/cve/CVE-2009-5155.html\nhttps://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-19",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CVE-2009-5155 (GCVE-0-2009-5155)

Vulnerability from cvelistv5 – Published: 2019-02-26 02:00 – Updated: 2024-08-07 07:32

Summary

In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

12 references

URL	Tags
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2019031…	x_refsource_CONFIRM
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806	x_refsource_MISC
https://sourceware.org/bugzilla/show_bug.cgi?id=18986	x_refsource_MISC
https://sourceware.org/git/gitweb.cgi?p=glibc.git…	x_refsource_MISC
http://git.savannah.gnu.org/cgit/gnulib.git/commi…	x_refsource_MISC
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238	x_refsource_MISC
https://sourceware.org/bugzilla/show_bug.cgi?id=11053	x_refsource_MISC
https://support.f5.com/csp/article/K64119434	x_refsource_CONFIRM
https://support.f5.com/csp/article/K64119434?utm_…	x_refsource_CONFIRM
https://lists.apache.org/thread.html/rf4c02775860…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r58af02e294b…	mailing-listx_refsource_MLIST

Date Public

2019-02-25 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:32:23.298Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190315-0002/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=18986"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=11053"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K64119434"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K64119434?utm_source=f5support\u0026amp%3Butm_medium=RSS"
          },
          {
            "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-02-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-29T14:09:50.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190315-0002/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=18986"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=11053"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K64119434"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K64119434?utm_source=f5support\u0026amp%3Butm_medium=RSS"
        },
        {
          "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-5155",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793",
              "refsource": "MISC",
              "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190315-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190315-0002/"
            },
            {
              "name": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806",
              "refsource": "MISC",
              "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806"
            },
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=18986",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=18986"
            },
            {
              "name": "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672",
              "refsource": "MISC",
              "url": "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672"
            },
            {
              "name": "http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272",
              "refsource": "MISC",
              "url": "http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272"
            },
            {
              "name": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238",
              "refsource": "MISC",
              "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238"
            },
            {
              "name": "https://sourceware.org/bugzilla/show_bug.cgi?id=11053",
              "refsource": "MISC",
              "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=11053"
            },
            {
              "name": "https://support.f5.com/csp/article/K64119434",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K64119434"
            },
            {
              "name": "https://support.f5.com/csp/article/K64119434?utm_source=f5support\u0026amp;utm_medium=RSS",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K64119434?utm_source=f5support\u0026amp;utm_medium=RSS"
            },
            {
              "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-5155",
    "datePublished": "2019-02-26T02:00:00.000Z",
    "dateReserved": "2019-02-25T00:00:00.000Z",
    "dateUpdated": "2024-08-07T07:32:23.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2021-05821 (CVE-2009-5155)

CVE-2009-5155 (GCVE-0-2009-5155)

Tags

Sightings

Nomenclature

Related by attack behaviour