CVE-2019-1010025 - Vulnerability Details - OpenCVE

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.02478.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

GNU Libc

glibc

affected

Version	Status	Constraints
`current (At least as of 2018-02-16)`	affected	—

Configuration 1 [-]

cpe:2.3:a:gnu:glibc:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors	Products
Gnu Subscribe	Glibc Subscribe

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://nvd.nist.gov/vuln/detail/CVE-2019-1010025
https://security-tracker.debian.org/tracker/CVE-2019-1010025
https://sourceware.org/bugzilla/show_bug.cgi?id=22853
https://support.f5.com/csp/article/K06046097
https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS
https://ubuntu.com/security/CVE-2019-1010025
https://www.cve.org/CVERecord?id=CVE-2019-1010025

History

Wed, 14 Oct 2026 09:30:00 +0000

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: dwf

Published: 2019-07-15T03:11:46.000Z

Updated: 2026-10-14T08:02:04.966Z

Reserved: 2019-03-20T00:00:00.000Z

Link: CVE-2019-1010025

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-07-15T04:15:13.537

Modified: 2026-10-14T09:17:15.880

Link: CVE-2019-1010025

Redhat

Severity : Low

Publid Date: 2019-07-15T00:00:00Z

Links: CVE-2019-1010025 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

{"containers": {"cna": {"affected": [{"product": "glibc", "vendor": "GNU Libc", "versions": [{"status": "affected", "version": "current (At least as of 2018-02-16)"}]}], "descriptions": [{"lang": "en", "value": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}], "problemTypes": [{"descriptions": [{"description": "Mitigation bypass", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-11-16T19:48:53.000Z", "orgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8", "shortName": "dwf"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.f5.com/csp/article/K06046097"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS"}, {"name": "CVE-2019-1010025", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010025"}, {"name": "CVE-2019-1010025", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://ubuntu.com/security/CVE-2019-1010025"}], "tags": ["disputed"], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-assign@distributedweaknessfiling.org", "ID": "CVE-2019-1010025", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "glibc", "version": {"version_data": [{"version_value": "current (At least as of 2018-02-16)"}]}}]}, "vendor_name": "GNU Libc"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Mitigation bypass"}]}]}, "references": {"reference_data": [{"name": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853", "refsource": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853"}, {"name": "https://support.f5.com/csp/article/K06046097", "refsource": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097"}, {"name": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS", "refsource": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS"}, {"name": "CVE-2019-1010025", "refsource": "DEBIAN", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010025"}, {"name": "CVE-2019-1010025", "refsource": "UBUNTU", "url": "https://ubuntu.com/security/CVE-2019-1010025"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:07:18.221Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.f5.com/csp/article/K06046097"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS"}, {"name": "CVE-2019-1010025", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010025"}, {"name": "CVE-2019-1010025", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://ubuntu.com/security/CVE-2019-1010025"}]}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-14T08:02:04.966Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}]}]}, "cveMetadata": {"assignerOrgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8", "assignerShortName": "dwf", "cveId": "CVE-2019-1010025", "datePublished": "2019-07-15T03:11:46.000Z", "dateReserved": "2019-03-20T00:00:00.000Z", "dateUpdated": "2026-10-14T08:02:04.966Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "glibc", "vendor": "GNU Libc", "versions": [{"status": "affected", "version": "current (At least as of 2018-02-16)"}]}], "source": "josh@bress.net"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:glibc:-:*:*:*:*:*:*:*", "matchCriteriaId": "68D5A70D-5CEE-4E19-BF35-0245A0E0F6BC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "josh@bress.net", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}, {"lang": "es", "value": "** EN DISPUTA **La biblioteca Libc actual de GNU est\u00e1 afectada por: Omisi\u00f3n de Mitigaci\u00f3n. El impacto es: el atacante puede adivinar las direcciones heap del subproceso (hilo) pthread_created. El componente es: glibc.NOTA: la posici\u00f3n del proveedor es \"ASLR bypass en s\u00ed mismo no es una vulnerabilidad\"."}], "id": "CVE-2019-1010025", "lastModified": "2026-10-14T09:17:15.880", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-07-15T04:15:13.537", "references": [{"source": "josh@bress.net", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010025"}, {"source": "josh@bress.net", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853"}, {"source": "josh@bress.net", "url": "https://support.f5.com/csp/article/K06046097"}, {"source": "josh@bress.net", "url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS"}, {"source": "josh@bress.net", "url": "https://ubuntu.com/security/CVE-2019-1010025"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010025"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.f5.com/csp/article/K06046097"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://ubuntu.com/security/CVE-2019-1010025"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}], "sourceIdentifier": "josh@bress.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-330"}], "source": "nvd@nist.gov", "type": "Primary"}]}