CVE-2017-1000366
published 2017-06-19CVE-2017-1000366: glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting…
PriorityP348high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
2.73%
86.0th percentile
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
Affected
62 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | glibc | < glibc 2.24-12 (bookworm) | glibc 2.24-12 (bookworm) |
| debian | glibc | < glibc 2.25-5 (bookworm) | glibc 2.25-5 (bookworm) |
| gnu | glibc | <= 2.25 | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | >= 0 < 2.25-5 | 2.25-5 |
| gnu | glibc | >= 0 < 2.24-12 | 2.24-12 |
| gnu | glibc | >= 0 < 2.25-5 | 2.25-5 |
| gnu | glibc | >= 0 < 2.24-12 | 2.24-12 |
| gnu | glibc | >= 0 < 2.25-5 | 2.25-5 |
| gnu | glibc | >= 0 < 2.24-12 | 2.24-12 |
| gnu | glibc | >= 0 < 2.25-5 | 2.25-5 |
| gnu | glibc | >= 0 < 2.24-12 | 2.24-12 |
| mcafee | web_gateway | <= 7.6.2.14 | — |
| mcafee | web_gateway | 7.7.0.0 – 7.7.2.2 | — |
| novell | suse_linux_enterprise_desktop | — | — |
| novell | suse_linux_enterprise_point_of_sale | — | — |
| novell | suse_linux_enterprise_server | — | — |
| openstack | cloud_magnum_orchestration | — | — |
| opensuse | leap | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
glibc: Memory leak reachable via LD_HWCAP_MASK
vendor_redhat·2017-12-11·CVSS 7.8
CVE-2017-1000408 [HIGH] CWE-400 glibc: Memory leak reachable via LD_HWCAP_MASK
glibc: Memory leak reachable via LD_HWCAP_MASK
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
Statement: This issue did not affect the versions of glibc as shipped with Red Hat Enterprise Linux 5, 6 and 7 after CVE-2017-1000366 fix:
https://access.redhat.com/security/cve/cve-2017-1000366
Package: compat-glibc (Red Hat Enterprise Linux 5) - Not affected
Package: glibc (Red Hat Enterprise Linux 5) - Not affected
Package: compat-glibc (Red Hat Enterprise Linux 6) - Not affected
Package: glibc (Red Hat Enterprise Linux 6) - Not affected
Package: compat-glibc (Red Hat Enterprise Linux 7) - Not affec
Red Hat
glibc: Buffer overflow triggerable via LD_LIBRARY_PATH
vendor_redhat·2017-12-11·CVSS 7.8
CVE-2017-1000409 [HIGH] CWE-120 glibc: Buffer overflow triggerable via LD_LIBRARY_PATH
glibc: Buffer overflow triggerable via LD_LIBRARY_PATH
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
Statement: This issue did not affect the versions of glibc as shipped with Red Hat Enterprise Linux 5, 6 and 7 after CVE-2017-1000366 fix:
https://access.redhat.com/security/cve/cve-2017-1000366
Package: compat-glibc (Red Hat Enterprise Linux 5) - Not affected
Package: glibc (Red Hat Enterprise Linux 5) - Not affected
Package: compat-glibc (Red Hat Enterprise Linux 6) - Not affected
Package: glibc (Red Hat Enterprise Linux 6) - Not affected
Package: compat-glibc (Red Hat Enterprise Linux 7) -
Ubuntu
GNU C Library vulnerability
vendor_ubuntu·2017-06-29
CVE-2017-1000366 GNU C Library vulnerability
Title: GNU C Library vulnerability
Summary: Gnu C library could be made to run programs as an administrator.
USN-3323-1 fixed a vulnerability in the GNU C Library. This update provides the
corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that the GNU C library did not properly handle memory
when processing environment variables for setuid programs. A local attacker
could use this in combination with another vulnerability to gain
administrative privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
glibc: heap/stack gap jumping via unbounded stack allocations
vendor_redhat·2017-06-19·CVSS 7.4
CVE-2017-1000366 [HIGH] glibc: heap/stack gap jumping via unbounded stack allocations
glibc: heap/stack gap jumping via unbounded stack allocations
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or
Ubuntu
GNU C Library vulnerability
vendor_ubuntu·2017-06-19
CVE-2017-1000366 GNU C Library vulnerability
Title: GNU C Library vulnerability
Summary: Gnu C library could be made to run programs as an administrator.
It was discovered that the GNU C library did not properly handle memory
when processing environment variables for setuid programs. A local attacker
could use this in combination with another vulnerability to gain
administrative privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
kernel: heap/stack gap jumping via unbounded stack allocations
vendor_redhat·2017-06-19·CVSS 7.4
CVE-2017-1000364 [HIGH] kernel: heap/stack gap jumping via unbounded stack allocations
kernel: heap/stack gap jumping via unbounded stack allocations
An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack g
Debian
CVE-2017-1000366: glibc - glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH val...
vendor_debian·2017·CVSS 7.8
CVE-2017-1000366 [HIGH] CVE-2017-1000366: glibc - glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH val...
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
Scope: local
bookworm: resolved (fixed in 2.24-12)
bullseye: resolved (fixed in 2.24-12)
forky: resolved (fixed in 2.24-12)
sid: resolved (fixed in 2.24-12)
trixie: resolved (fixed in 2.24-12)
Debian
CVE-2017-1000408: glibc - A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and ampli...
vendor_debian·2017·CVSS 7.8
CVE-2017-1000408 [HIGH] CVE-2017-1000408: glibc - A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and ampli...
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
Scope: local
bookworm: resolved (fixed in 2.25-5)
bullseye: resolved (fixed in 2.25-5)
forky: resolved (fixed in 2.25-5)
sid: resolved (fixed in 2.25-5)
trixie: resolved (fixed in 2.25-5)
Debian
CVE-2017-1000409: glibc - A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be trigg...
vendor_debian·2017·CVSS 7.8
CVE-2017-1000409 [HIGH] CVE-2017-1000409: glibc - A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be trigg...
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
Scope: local
bookworm: resolved (fixed in 2.25-5)
bullseye: resolved (fixed in 2.25-5)
forky: resolved (fixed in 2.25-5)
sid: resolved (fixed in 2.25-5)
trixie: resolved (fixed in 2.25-5)
GHSA
GHSA-6rpv-6r2m-9c95: A buffer overflow in glibc 2
ghsa_unreviewed·2022-05-14·CVSS 7.8
CVE-2017-1000409 [HIGH] CWE-119 GHSA-6rpv-6r2m-9c95: A buffer overflow in glibc 2
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
GHSA
GHSA-45fw-2mcw-h3gw: glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially r
ghsa_unreviewed·2022-05-13
CVE-2017-1000366 [HIGH] CWE-119 GHSA-45fw-2mcw-h3gw: glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially r
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
GHSA
GHSA-h374-m7g3-c2ww: A memory leak in glibc 2
ghsa_unreviewed·2022-05-13·CVSS 7.8
CVE-2017-1000408 [HIGH] CWE-772 GHSA-h374-m7g3-c2ww: A memory leak in glibc 2
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
OSV
CVE-2017-1000408: A memory leak in glibc 2
osv·2018-02-01·CVSS 7.8
CVE-2017-1000408 [HIGH] CVE-2017-1000408: A memory leak in glibc 2
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
OSV
CVE-2017-1000409: A buffer overflow in glibc 2
osv·2018-02-01·CVSS 7.8
CVE-2017-1000409 [HIGH] CVE-2017-1000409: A buffer overflow in glibc 2
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
OSV
CVE-2017-1000366: glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially r
osv·2017-06-19·CVSS 7.8
CVE-2017-1000366 [HIGH] CVE-2017-1000366: glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially r
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
No detection rules found.
Exploit-DB
GNU C Library Dynamic Loader glibc ld.so - Memory Leak / Buffer Overflow
exploitdb·2017-12-13·CVSS 7.8
CVE-2017-1000409 [HIGH] GNU C Library Dynamic Loader glibc ld.so - Memory Leak / Buffer Overflow
GNU C Library Dynamic Loader glibc ld.so - Memory Leak / Buffer Overflow
---
Qualys Security Advisory
Buffer overflow in glibc's ld.so
Contents
Summary
Memory Leak
Buffer Overflow
Exploitation
Acknowledgments
Summary
We have discovered a memory leak and a buffer overflow in the dynamic
loader (ld.so) of the GNU C Library (glibc):
- the memory leak (CVE-2017-1000408) first appeared in glibc 2.1.1
(released on May 24, 1999) and can be reached and amplified through
the LD_HWCAP_MASK environment variable;
- the buffer overflow (CVE-2017-1000409) first appeared in glibc 2.5
(released on September 29, 2006) and can be triggered through the
LD_LIBRARY_PATH environment variable.
Further investigation showed that:
- the buffer overflow is not exploitable if
/proc/sys/fs/protected_hardl
Exploit-DB
Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64 Stack Clash' Local Privilege Escalation
exploitdb·2017-06-28·CVSS 7.8
CVE-2017-1000379 [HIGH] Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64 Stack Clash' Local Privilege Escalation
Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64 Stack Clash' Local Privilege Escalation
---
/*
* Linux_ldso_hwcap_64.c for CVE-2017-1000366, CVE-2017-1000379
* Copyright (C) 2017 Qualys, Inc.
*
* my_important_hwcaps() adapted from elf/dl-hwcaps.c,
* part of the GNU C Library:
* Copyright (C) 2012-2017 Free Software Foundation, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABIL
Exploit-DB
Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic Stack Clash' Local Privilege Escalation
exploitdb·2017-06-28·CVSS 7.8
CVE-2017-1000371 [HIGH] Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic Stack Clash' Local Privilege Escalation
Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic Stack Clash' Local Privilege Escalation
---
/*
* Linux_ldso_dynamic.c for CVE-2017-1000366, CVE-2017-1000371
* Copyright (C) 2017 Qualys, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
Exploit-DB
Linux Kernel (Debian 7/8/9/10 / Fedora 23/24/25 / CentOS 5.3/5.11/6.0/6.8/7.2.1511) - 'ldso_hwcap Stack Clash' Local Privilege Escalation
exploitdb·2017-06-28·CVSS 7.8
CVE-2017-1000370 [HIGH] Linux Kernel (Debian 7/8/9/10 / Fedora 23/24/25 / CentOS 5.3/5.11/6.0/6.8/7.2.1511) - 'ldso_hwcap Stack Clash' Local Privilege Escalation
Linux Kernel (Debian 7/8/9/10 / Fedora 23/24/25 / CentOS 5.3/5.11/6.0/6.8/7.2.1511) - 'ldso_hwcap Stack Clash' Local Privilege Escalation
---
/*
* Linux_ldso_hwcap.c for CVE-2017-1000366, CVE-2017-1000370
* Copyright (C) 2017 Qualys, Inc.
*
* my_important_hwcaps() adapted from elf/dl-hwcaps.c,
* part of the GNU C Library:
* Copyright (C) 2012-2017 Free Software Foundation, Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A
Bugzilla
CVE-2017-1000409 glibc: Buffer overflow triggerable via LD_LIBRARY_PATH
bugzilla·2017-12-06·CVSS 7.8
CVE-2017-1000409 [HIGH] CVE-2017-1000409 glibc: Buffer overflow triggerable via LD_LIBRARY_PATH
CVE-2017-1000409 glibc: Buffer overflow triggerable via LD_LIBRARY_PATH
It was found that a buffer overflow can be triggered through the LD_LIBRARY_PATH environment variable.
Discussion:
Acknowledgments:
Name: Qualys Research Labs
---
Public via:
http://seclists.org/oss-sec/2017/q4/385
---
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1524867]
---
Statement:
This issue did not affect the versions of glibc as shipped with Red Hat Enterprise Linux 5, 6 and 7 after CVE-2017-1000366 fix:
https://access.redhat.com/security/cve/cve-2017-1000366
---
Upstream bug:
https://sourceware.org/bugzilla/show_bug.cgi?id=22607
Upstream commit:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=3ff3dfa5af313a6ea33f3393916f30eece4f0171
Bugzilla
CVE-2017-1000408 glibc: Memory leak reachable via LD_HWCAP_MASK
bugzilla·2017-12-06·CVSS 7.8
CVE-2017-1000408 [HIGH] CVE-2017-1000408 glibc: Memory leak reachable via LD_HWCAP_MASK
CVE-2017-1000408 glibc: Memory leak reachable via LD_HWCAP_MASK
It was found that a memory leak can be reached and amplified through the LD_HWCAP_MASK environment variable. It's not exploitable if the glibc is patched against CVE-2017-1000366, because this patch ignores the LD_HWCAP_MASK and LD_LIBRARY_PATH environment variables when SUID binaries are executed
Introducing commit:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=ab7eb292307152e706948a7b19164ff5e6d593d4
Discussion:
Acknowledgments:
Name: Qualys Research Labs
---
Public via:
http://seclists.org/oss-sec/2017/q4/385
---
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1524867]
---
Statement:
This issue did not affect the versions of glibc as shipped with Red Hat Enterprise Linux 5,
Bugzilla
CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations [fedora-all]
bugzilla·2017-06-19·CVSS 7.8
CVE-2017-1000366 [HIGH] CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations [fedora-all]
CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supp
Bugzilla
CVE-2017-1000364 kernel: heap/stack gap jumping via unbounded stack allocations
bugzilla·2017-06-14·CVSS 7.4
CVE-2017-1000364 [HIGH] CVE-2017-1000364 kernel: heap/stack gap jumping via unbounded stack allocations
CVE-2017-1000364 kernel: heap/stack gap jumping via unbounded stack allocations
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system.
This is a tracking bug for the kernel part of the mitigation.
Upstream kernel patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1be7107fbe18eed3e319a6c3e83c78254b693acb
Discussion:
Acknowledgments:
Name: Qualys Research Labs
---
External References:
https://access.redhat.com/security/vulnerabiliti
Bugzilla
CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations
bugzilla·2017-05-19·CVSS 7.8
CVE-2017-1000366 [HIGH] CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations
CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the heap/stack gap, cause controlled memory corruption on process stack or heap, and thus increase their privileges on the system.
This is a tracking bug for the glibc part of the mitigation.
Discussion:
Acknowledgments:
Name: Qualys Research Labs
---
External References:
https://access.redhat.com/security/vulnerabilities/stackguard
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
---
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1462820]
---
This issue has been addre
http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.htmlhttp://seclists.org/fulldisclosure/2019/Sep/7http://www.debian.org/security/2017/dsa-3887http://www.securityfocus.com/bid/99127http://www.securitytracker.com/id/1038712https://access.redhat.com/errata/RHSA-2017:1479https://access.redhat.com/errata/RHSA-2017:1480https://access.redhat.com/errata/RHSA-2017:1481https://access.redhat.com/errata/RHSA-2017:1567https://access.redhat.com/errata/RHSA-2017:1712https://access.redhat.com/security/cve/CVE-2017-1000366https://kc.mcafee.com/corporate/index?page=content&id=SB10205https://seclists.org/bugtraq/2019/Sep/7https://security.gentoo.org/glsa/201706-19https://www.exploit-db.com/exploits/42274/https://www.exploit-db.com/exploits/42275/https://www.exploit-db.com/exploits/42276/https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txthttps://www.suse.com/security/cve/CVE-2017-1000366/https://www.suse.com/support/kb/doc/?id=7020973http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.htmlhttp://seclists.org/fulldisclosure/2019/Sep/7http://www.debian.org/security/2017/dsa-3887http://www.securityfocus.com/bid/99127http://www.securitytracker.com/id/1038712https://access.redhat.com/errata/RHSA-2017:1479https://access.redhat.com/errata/RHSA-2017:1480https://access.redhat.com/errata/RHSA-2017:1481https://access.redhat.com/errata/RHSA-2017:1567https://access.redhat.com/errata/RHSA-2017:1712https://access.redhat.com/security/cve/CVE-2017-1000366https://kc.mcafee.com/corporate/index?page=content&id=SB10205https://seclists.org/bugtraq/2019/Sep/7https://security.gentoo.org/glsa/201706-19https://www.exploit-db.com/exploits/42274/https://www.exploit-db.com/exploits/42275/https://www.exploit-db.com/exploits/42276/https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txthttps://www.suse.com/security/cve/CVE-2017-1000366/https://www.suse.com/support/kb/doc/?id=7020973
2017-06-19
Published