Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2966 advisory.

  - Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial     of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.
    (CVE-2016-9427)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the gc package has been released.

According to the version of the gc package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Integer overflow vulnerability in bdwgc before     2016-09-27 allows attackers to cause client of bdwgc     denial of service (heap buffer overflow crash) and     possibly execute arbitrary code via huge     allocation.(CVE-2016-9427)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kuang-che Wu discovered that multiple integer overflow vulnerabilities existed in libgc. An attacker could use these to cause a denial of service (application crash) or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gc fixes the following issues :

  - integer overflow in GC_MALLOC_ATOMIC() (CVE-2016-9427,     bsc#1011276)

This update for gc fixes the following issues :

  - integer overflow in GC_MALLOC_ATOMIC() (CVE-2016-9427,     bsc#1011276)

This update was imported from the SUSE:SLE-12:Update update project.

This update for gc fixes the following issues :

  - integer overflow in GC_MALLOC_ATOMIC() (CVE-2016-9427,     bsc#1011276)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libgc is vulnerable to integer overflows in multiple places. In some cases, when asked to allocate a huge quantity of memory, instead of failing the request, it will return a pointer to a small amount of memory possibly tricking the application into a buffer overwrite.

For Debian 7 'Wheezy', these problems have been fixed in version 1:7.1-9.1+deb7u1.

We recommend that you upgrade your libgc packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
159474	Debian DLA-2966-1 : libgc - LTS security update	Nessus	Debian Local Security Checks	critical
132694	Photon OS 1.0: Gc PHSA-2019-1.0-0260	Nessus	PhotonOS Local Security Checks	critical
132299	EulerOS 2.0 SP3 : gc (EulerOS-SA-2019-2582)	Nessus	Huawei Local Security Checks	critical
131800	EulerOS 2.0 SP5 : gc (EulerOS-SA-2019-2526)	Nessus	Huawei Local Security Checks	critical
131605	EulerOS 2.0 SP2 : gc (EulerOS-SA-2019-2451)	Nessus	Huawei Local Security Checks	critical
97208	Ubuntu 14.04 LTS / 16.04 LTS : libgc vulnerability (USN-3197-1)	Nessus	Ubuntu Local Security Checks	critical
96028	openSUSE Security Update : gc (openSUSE-2016-1487)	Nessus	SuSE Local Security Checks	critical
95793	openSUSE Security Update : gc (openSUSE-2016-1479)	Nessus	SuSE Local Security Checks	critical
95652	SUSE SLED12 / SLES12 Security Update : gc (SUSE-SU-2016:3057-1)	Nessus	SuSE Local Security Checks	critical
95357	Debian DLA-721-1 : libgc security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-9427

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical