• shadowintheday2@lemmy.world
    link
    fedilink
    English
    arrow-up
    90
    arrow-down
    2
    ·
    8 months ago

    "A qsort vulnerability is due to a missing bounds check and can lead to memory corruption. It has been present in all versions of glibc since 1992. "

    This one amazes me. Imagine how many vulnerabilities future researchers will discover in ancient software that persisted/persist for decades.

    • PlexSheep@feddit.de
      link
      fedilink
      arrow-up
      63
      ·
      edit-2
      8 months ago

      That’s not the main part of the article, just a footnote, for anyone wondering.

      The flaw resides in the glibc’s syslog function, an attacker can exploit the flaw to gain root access through a privilege escalation.

      The vulnerability was introduced in glibc 2.37 in August 2022.