The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length which may result in a buffer overflow potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

🗓️ 22 Jan 2022 08:00:00Reported by MicrosoftType

Deprecated glibc clnt_create copies hostname on the stack without length checks, causing buffer overflow.

Reporter	Title	Published	Views	Family All 173
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities.	11 Apr 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to stack-based buffer overflow in GNU C Library (CVE-2022-23219)	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	26 Jul 202214:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security is vulnerable to using components with known vulnerabilities	28 Oct 202219:52	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in glibc affects IBM Integrated Analytics System [CVE-2022-23219]	27 Sep 202410:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data are addressed	3 Mar 202514:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and IBM supplied MQ Advanced container images are vulnerable to multiple issues from Red Hat UBI packages and the IBM WebSphere Application Server Liberty	16 May 202208:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in expat, glibc, http server, dojo, openssl shipped with IBM Cloud Pak System	15 Aug 202221:35	–	ibm
IBM Security Bulletins	Security Bulletin: App Connect Professional is affected by GNU C Library vulnerability	20 Apr 202214:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	19 Jan 202313:54	–	ibm

Vulners

Node

microsoft cbl2_glibc_2.35-1Range<2.35-1

22 Jan 2022 08:00Current

7.4High risk

Vulners AI Score7.4

CVSS 27.5

CVSS 3.19.8

EPSS0.04211

SSVC