CVE-2024-33602

2024-05-0620:15:11

Debian Security Bug Tracker

security-tracker.debian.org

nss callback

netgroup cache

security vulnerability

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon’s (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

OSVersionArchitecturePackageVersionFilename
Debian12allglibc< 2.36-9+deb12u7glibc_2.36-9+deb12u7_all.deb
Debian11allglibc< 2.31-13+deb11u10glibc_2.31-13+deb11u10_all.deb
Debian10allglibc<= 2.28-10+deb10u1glibc_2.28-10+deb10u1_all.deb
Debian999allglibc< 2.37-19glibc_2.37-19_all.deb
Debian13allglibc< 2.37-19glibc_2.37-19_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	glibc	< 2.36-9+deb12u7	glibc_2.36-9+deb12u7_all.deb
Debian	11	all	glibc	< 2.31-13+deb11u10	glibc_2.31-13+deb11u10_all.deb
Debian	10	all	glibc	<= 2.28-10+deb10u1	glibc_2.28-10+deb10u1_all.deb
Debian	999	all	glibc	< 2.37-19	glibc_2.37-19_all.deb
Debian	13	all	glibc	< 2.37-19	glibc_2.37-19_all.deb