Debian Glibc vulnerabilities

CVE-2023-4911 [HIGH] CVE-2023-4911: glibc - A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so whi... A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges. Scope: local bookworm: resolved (fixed in 2.36

CVE-2015-7547 [HIGH] CVE-2015-7547: glibc - Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functio... Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address

CVE-2024-2961 [HIGH] CVE-2024-2961: glibc - The iconv() function in the GNU C Library versions 2.39 and older may overflow t... The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. Scope: local bookworm: resolved (fixed in 2.36-9+deb12u6) bullseye: resolved (fixed in 2.31-13+deb11u9)

CVE-2018-1000001 [HIGH] CVE-2018-1000001: glibc - In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpat... In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. Scope: local bookworm: resolved (fixed in 2.26-4) bullseye: resolved (fixed in 2.26-4) forky: resolved (fixed in 2.26-4) sid: resolved (fixed in 2.26-4) trixie: reso

CVE-2015-0235 [CRITICAL] CVE-2015-0235: glibc - Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2... Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST." Scope: local bookworm: resolved (fixed in 2.18-1) bullseye: resolved (fixed in 2.18-1) forky: res

CVE-2014-5119 [HIGH] CVE-2014-5119: glibc - Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C... Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules. Scope: local bookworm: resolved (fixed in 2.19-10) bullseye: resolved (fixed in 2.

CVE-2008-1391 [HIGH] CVE-2008-1391: glibc - Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and proba... Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, relat

CVE-2012-4412 [HIGH] CVE-2012-4412: glibc - Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6)... Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow. Scope: local bookworm: resolved (fixed in 2.17-94) bullseye: resolved (fixed in 2.17-94) forky: resolve

CVE-2023-6246 [HIGH] CVE-2023-6246: glibc - A heap-based buffer overflow was found in the __vsyslog_internal function of the... A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash

CVE-2010-4052 [MEDIUM] CVE-2010-4052: glibc - Stack consumption vulnerability in the regcomp implementation in the GNU C Libra... Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.

CVE-2010-3847 [MEDIUM] CVE-2010-3847: glibc - elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2,... elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory. Scope: local bookworm: resolved (fixed in 2.11.2-8) bullse

CVE-2017-1000366 [HIGH] CVE-2017-1000366: glibc - glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH val... glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they

CVE-2010-4051 [MEDIUM] CVE-2010-4051: glibc - The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.1... The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in th

CVE-2016-2856 [HIGH] CVE-2016-2856: glibc - pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc ... pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS; and the glibc package before 2.21-0ubuntu4.2 on Ubuntu 15.10 and before 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10 lacks a namespace check associated with file-descriptor passing, which allo

CVE-2010-3856 [HIGH] CVE-2010-3856: glibc - ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before... ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so. Scope:

CVE-2017-1000408 [HIGH] CVE-2017-1000408: glibc - A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and ampli... A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366. Scope: local bookworm: resolved (fixed in 2.25-5) bullseye: resolved (fixed in 2.25-5) forky: resolved (fixed in 2.25-5) sid: r

CVE-2011-1071 [MEDIUM] CVE-2011-1071: glibc - The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC)... The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported

CVE-2009-5029 [MEDIUM] CVE-2009-5029: glibc - Integer overflow in the __tzfile_read function in glibc before 2.15 allows conte... Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd. Scope: local bookworm: resolved (fixed in 2.13-24) bullseye: resolved (fixed in 2.13-24) forky: resolved (fixed in 2.13-24) sid: r

CVE-2013-4788 [MEDIUM] CVE-2013-4788: glibc - The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.1... The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer gua

CVE-2002-0391 [CRITICAL] CVE-2002-0391: acm - Integer overflow in xdr_array function in RPC servers for operating systems that... Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd. Scope: local bookworm: resolved (fixed in 5.0-10) bullseye: resolved (