Mandriva Linux Security Advisory : gc (MDVSA-2012:158)

Medium Nessus Plugin ID 62424


The remote Mandriva Linux host is missing one or more security updates.


A security issue was identified and fixed in gc :

Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc funtions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected (CVE-2012-2673).

The updated packages have been patched to correct this issue.


Update the affected packages.

Plugin Details

Severity: Medium

ID: 62424

File Name: mandriva_MDVSA-2012-158.nasl

Version: $Revision: 1.5 $

Type: local

Published: 2012/10/04

Modified: 2013/11/05

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64gc-devel, p-cpe:/a:mandriva:linux:lib64gc-static-devel, p-cpe:/a:mandriva:linux:lib64gc1, p-cpe:/a:mandriva:linux:libgc-devel, p-cpe:/a:mandriva:linux:libgc-static-devel, p-cpe:/a:mandriva:linux:libgc1, cpe:/o:mandriva:linux:2011

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2012/10/03

Reference Information

CVE: CVE-2012-2673

BID: 54227

MDVSA: 2012:158