CVE-2020-29573

Name	CVE-2020-29573
Description	sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glibc (PTS)	buster	2.28-10+deb10u1	fixed
	buster (security)	2.28-10+deb10u2	fixed
	bullseye	2.31-13+deb11u8	fixed
	bullseye (security)	2.31-13+deb11u7	fixed
	bookworm, bookworm (security)	2.36-9+deb12u4	fixed
	trixie	2.37-15	fixed
	sid	2.37-18	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glibc	source	(unstable)	2.23-1

Notes

https://sourceware.org/bugzilla/show_bug.cgi?id=26649
https://sourceware.org/pipermail/libc-alpha/2020-September/117779.html
https://bugzilla.redhat.com/show_bug.cgi?id=1905213#c5
Fixed by: https://sourceware.org/git/?p=glibc.git;h=d81f90ccd0109de9ed78aeeb8d86e2c6d4600690 (glibc-2.22)
Fixed by: https://sourceware.org/git/?p=glibc.git;h=8df4e219e43a4a257d0759b54fef8c488e2f282e (glibc-2.23)