CVE-2010-4756

Name	CVE-2010-4756
Description	The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
eglibc (PTS)	wheezy	2.13-38+deb7u10	vulnerable
	wheezy (security)	2.13-38+deb7u12	vulnerable
glibc (PTS)	jessie	2.19-18+deb8u9	vulnerable
	jessie (security)	2.19-18+deb8u10	vulnerable
	stretch	2.24-11	vulnerable
	stretch (security)	2.24-11+deb9u1	vulnerable
	buster, sid	2.24-12	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
eglibc	source	(unstable)	(unfixed)	unimportant
glibc	source	(unstable)	(unfixed)	unimportant

That's standard POSIX behaviour implemented by (e)glibc. Applications using
glob need to impose limits for themselves