Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the libc6-sparcv9 package of the Debian GNU/Linux operating system may lead to breaches of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

CVE-2015-1472

CVE-2015-1472 affects the GNU C Library (glibc) prior to 2.21. The ADDW macro in stdio-common/vfscanf.c can miscalculate allocation size, leading to buffer overflows in wide-character handling during wscanf, enabling context-dependent denial of service and potentially other impact. Affected compo...

CVE-2015-1473: Improper Restriction of Operations within the Bounds of a Memory Buffer

The ADDW macro in stdio-common/vfscanf.c in the GNU C Library aka glibc or libc6 before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service segmentation violatio...

CVE-2015-1472: Improper Restriction of Operations within the Bounds of a Memory Buffer

The ADDW macro in stdio-common/vfscanf.c in the GNU C Library aka glibc or libc6 before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service buffer overflow or possibly have unspecified other impact via a lo...

CVE-2014-8121

DBLOOKUP in nssfiles/files-XXX.c in the Name Service Switch NSS in GNU C Library aka glibc or libc6 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service infinite loop by performing a look-up on a database while iterating over it,...

CVE-2014-8121: Undefined Security Weakness

DBLOOKUP in nssfiles/files-XXX.c in the Name Service Switch NSS in GNU C Library aka glibc or libc6 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service infinite loop by performing a look-up on a database while iterating over it,...

CVE-2014-8121

DBLOOKUP in nssfiles/files-XXX.c in the Name Service Switch NSS in GNU C Library aka glibc or libc6 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service infinite loop by performing a look-up on a database while iterating over it,...

CVE-2013-7423

The senddg function in resolv/ressend.c in GNU C Library aka glibc or libc6 before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function...

CVE-2013-7423

CVE-2013-7423: in glibc, the send_dg path can cause DNS queries to be written to unintended file descriptors under load, enabling local access to sensitive information. IBM advisories confirm affected products (e.g., DataPower Gateways, QRadar/NIPS contexts) and list concrete fixes: upgrade to fi...

CVE-2013-7423: Undefined Security Weakness

The senddg function in resolv/ressend.c in GNU C Library aka glibc or libc6 before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function...

Ubuntu 10.04 LTS / 12.04 LTS : eglibc vulnerability (USN-2485-1) (GHOST)

It was discovered that a buffer overflow existed in the gethostbyname and gethostbyname2 functions in the GNU C Library. An attacker could use this issue to execute arbitrary code or cause an application crash, resulting in a denial of service. Note that Tenable Network Security has extracted the...

CVE-2014-0475

CVE-2014-0475 affects glibc (GNU C Library) before 2.20, enabling context-dependent attackers to bypass ForceCommand restrictions via dot-dot in locale environment variables (LC_* or LANG). Connected documents corroborate glibc/eglibc impact and reference related advisories from IBM for FlashSyst...

CVE-2014-0475

Multiple directory traversal vulnerabilities in GNU C Library aka glibc or libc6 before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. dot dot in a 1 LC, 2 LANG, or other locale environment variable...

CVE-2014-0475: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in GNU C Library aka glibc or libc6 before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. dot dot in a 1 LC, 2 LANG, or other locale environment variable...

CVE-2013-4458

CVE-2013-4458 describes a stack-based overflow in glibc's getaddrinfo (sysdeps/posix/getaddrinfo.c) that can cause DoS via a hostname or IP that yields many AF_INET6 results. Concrete tie-ins exist: CVE-2016-3706 notes this vulnerability exists due to an incomplete fix for CVE-2013-4458, and Debi...

CVE-2013-4458: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library aka glibc or libc6 2.18 and earlier allows remote attackers to cause a denial of service crash via a 1 hostname or 2 IP address that triggers a large number of AFINET6 address results. NOTE: th...

CVE-2013-4237

CVE-2013-4237 affects glibc (GNU C Library) 2.18 and earlier, in sysdeps/posix/readdir_r.c. A context-dependent attacker could trigger an out-of-bounds write in readdir_r via a crafted NTFS or CIFS image, causing a denial of service or potentially executing arbitrary code. Exploitation details ar...

CVE-2013-2207

CVE-2013-2207: In the GNU C Library (glibc), pt_chown() can bypass security restrictions due to improper permission checks, allowing a local attacker to access other users’ pseudoterminals. The vulnerability affects glibc versions before 2.18. IBM advisories (FSM, IMM2, AMM) reference CVE-2013-22...

CVE-2013-4332

CVE-2013-4332 affects the GNU C Library (glibc) and is described in multiple IBM advisories as caused by an integer overflow in malloc-related code (malloc/malloc.c) that can overflow when a large value is passed to pvalloc, valloc, posix_memalign, memalign, or aligned_alloc. The consequence cite...

CVE-2013-4332: Undefined Security Weakness

Multiple integer overflows in malloc/malloc.c in the GNU C Library aka glibc or libc6 2.18 and earlier allow context-dependent attackers to cause a denial of service heap corruption via a large value to the 1 pvalloc, 2 valloc, 3 posixmemalign, 4 memalign, or 5 alignedalloc functions...