CVE-1999-0199
Description
From CVE.org
manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.
Statement
Red Hat Product Security does not feel that this issue has any security impact because the CVE description suggests that a missing statement in the manpage could lead to a generalized developer awareness problem, that in turn could potentially lead to a flaw. Thus, there is no actual exploitable vulnerability reported in this CVE, but rather, the possibility that one could occur in some unspecified software which uses glibc where the developers haven't read the manpage since 1999. There is no direct way for a vulnerability to come to fruition in software based solely on developer knowledge (or lack thereof), but an implementation of that knowledge, which is absent from the description of this issue.
This manpage issue does not affect glibc as shipped with Red Hat Enterprise Linux 5, 6, 7, or 8 as the versions of glibc shipped already have the updated manpage.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 0 | 9.8 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | High | N/A |
| Integrity Impact | None | High | N/A |
| Availability Impact | None | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
This CVE is at most a documentation bug that has no direct security impact. It is not a software vulnerability in any particular application. C:H I:H and A:H does not seem appropriate here.
Understanding the Weakness (CWE)
Other
Technical Impact: Reduce Maintainability; Increase Analytical Complexity
This issue can make it more difficult to understand and maintain the product. It can make it more difficult and time-consuming to detect and/or fix vulnerabilities.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
