Fluid Attacks Database

Description

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	glibc	>=0 <2.40-6	2.40-6
debian 11	glibc	=2.31-13 \|\| =2.31-13+deb11u1 \|\| =2.31-13+deb11u10 \|\| =2.31-13+deb11u11 \|\| =2.31-13+deb11u2 \|\| =2.31-13+deb11u3 \|\| =2.31-13+deb11u4 \|\| =2.31-13+deb11u5 \|\| =2.31-13+deb11u6 \|\| =2.31-13+deb11u7 \|\| =2.31-13+deb11u8 \|\| =2.31-13+deb11u9 \|\| >=0 <2.31-13+deb11u12	2.31-13+deb11u12
debian 12	glibc	=2.36-9 \|\| =2.36-9+deb12u1 \|\| =2.36-9+deb12u2 \|\| =2.36-9+deb12u3 \|\| =2.36-9+deb12u4 \|\| =2.36-9+deb12u5 \|\| =2.36-9+deb12u6 \|\| =2.36-9+deb12u7 \|\| =2.36-9+deb12u8 \|\| =2.36-9+deb12u9 \|\| >=0 <2.36-9+deb12u10	2.36-9+deb12u10
debian 13	glibc	>=0 <2.40-6	2.40-6
rpm rhel6	glibc	-	-
rpm rhel8	glibc	<0:2.28-251.el8_10.16	0:2.28-251.el8_10.16
rpm rhel7	glibc	-	-
rpm rhel6	compat-glibc	-	-
rpm rhel7	compat-glibc	-	-
rpm rhel9	glibc	<0:2.34-125.el9_5.8	0:2.34-125.el9_5.8

1-10 of 12

Aliases

1. CVE-2025-03952. NVD-2025-03953. OSV-DEBIAN-2025-03954. OSV-2025-03955. SECURITY-TRACKER-CVE-2025-0395

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.