CVE-2005-3590
glibc: buffer overflow in getgrouplist function leading to corrupted memory
Severity
LowRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · April 10, 2019
Updated · November 22, 2025
Description
The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')