QID 352480

<DIV ID="issue_overview"> a vulnerability was discovered in glibc where the ld_prefer_map_32bit_exec environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures.
This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (aslr).
The highest threat is confidentiality although the complexity of attack is high.
The affected application must already have other vulnerabilities for this flaw to be usable. (
cve-2019-19126 ) a flaw was found in glibc.
When processing input in the euc-kr encoding, an invalid input sequence could cause glibc to read beyond the end of a buffer, resulting in a segmentation fault.
The highest threat from this vulnerability is to system availability. (
cve-2019-25013 ) a flaw was found in glibc in versions prior to 2.32.
Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow.
cve-2020-10029 ) a stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an 80-bit long double with a non-canonical bit pattern.
This flaw allows an attacker who can control the arguments of these functions with the non-standard long double pattern to trigger an overflow and cause an application crash.
cve-2020-29573 ) </DIV>

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.