Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Garbage_collector | Boehm-demers-weiser | * | 7.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.3 (including) | 1.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.4 (including) | 1.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.5 (including) | 1.5 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.8 (including) | 1.8 (including) |
| Garbage_collector | Boehm-demers-weiser | 1.9 (including) | 1.9 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.0 (including) | 2.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.1 (including) | 2.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.2 (including) | 2.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.3 (including) | 2.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 2.4 (including) | 2.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.0 (including) | 3.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.1 (including) | 3.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.2 (including) | 3.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.3 (including) | 3.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.4 (including) | 3.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.5 (including) | 3.5 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.6 (including) | 3.6 (including) |
| Garbage_collector | Boehm-demers-weiser | 3.7 (including) | 3.7 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.0 (including) | 4.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.1 (including) | 4.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.2 (including) | 4.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.3 (including) | 4.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.4 (including) | 4.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.5 (including) | 4.5 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.6 (including) | 4.6 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.7 (including) | 4.7 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.8 (including) | 4.8 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.9 (including) | 4.9 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.10 (including) | 4.10 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.11 (including) | 4.11 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.12 (including) | 4.12 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.13 (including) | 4.13 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.14 (including) | 4.14 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.14-alpha1 (including) | 4.14-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 4.14-alpha2 (including) | 4.14-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0 (including) | 5.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha1 (including) | 5.0-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha2 (including) | 5.0-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha3 (including) | 5.0-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha4 (including) | 5.0-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha6 (including) | 5.0-alpha6 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.0-alpha7 (including) | 5.0-alpha7 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.1 (including) | 5.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.2 (including) | 5.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.3 (including) | 5.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 5.4 (including) | 5.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0 (including) | 6.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha1 (including) | 6.0-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha2 (including) | 6.0-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha3 (including) | 6.0-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha4 (including) | 6.0-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha5 (including) | 6.0-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha6 (including) | 6.0-alpha6 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha7 (including) | 6.0-alpha7 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha8 (including) | 6.0-alpha8 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.0-alpha9 (including) | 6.0-alpha9 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1 (including) | 6.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha1 (including) | 6.1-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha2 (including) | 6.1-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha3 (including) | 6.1-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha4 (including) | 6.1-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.1-alpha5 (including) | 6.1-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2 (including) | 6.2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha1 (including) | 6.2-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha2 (including) | 6.2-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha3 (including) | 6.2-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha4 (including) | 6.2-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha5 (including) | 6.2-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.2-alpha6 (including) | 6.2-alpha6 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3 (including) | 6.3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha1 (including) | 6.3-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha2 (including) | 6.3-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha3 (including) | 6.3-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha4 (including) | 6.3-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha5 (including) | 6.3-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.3-alpha6 (including) | 6.3-alpha6 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.4 (including) | 6.4 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.5 (including) | 6.5 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.6 (including) | 6.6 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.7 (including) | 6.7 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.8 (including) | 6.8 (including) |
| Garbage_collector | Boehm-demers-weiser | 6.9 (including) | 6.9 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0 (including) | 7.0 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha1 (including) | 7.0-alpha1 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha2 (including) | 7.0-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha3 (including) | 7.0-alpha3 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha4 (including) | 7.0-alpha4 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha5 (including) | 7.0-alpha5 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha7 (including) | 7.0-alpha7 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.0-alpha9 (including) | 7.0-alpha9 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.1 (including) | 7.1 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.1-alpha2 (including) | 7.1-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.2-alpha2 (including) | 7.2-alpha2 (including) |
| Garbage_collector | Boehm-demers-weiser | 7.2-alpha4 (including) | 7.2-alpha4 (including) |
| Libgc | Ubuntu | devel | * |
| Libgc | Ubuntu | hardy | * |
| Libgc | Ubuntu | lucid | * |
| Libgc | Ubuntu | natty | * |
| Libgc | Ubuntu | oneiric | * |
| Libgc | Ubuntu | precise | * |
| Red Hat Enterprise Linux 6 | RedHat | gc-0:7.1-12.el6_4 | * |
| Red Hat Satellite 5.6 | RedHat | gc-0:7.1-12.2.el5sat | * |
| Red Hat Satellite Proxy v 5.6 | RedHat | gc-0:7.1-12.2.el5sat | * |