MEDIUM6.8
Уязвимость библиотеки, обеспечивающей системные вызовы и основные функции glibc, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PReferences
Severity:
Closed issues (10)
HIGH7.5
Уязвимость службы nscd библиотеки, обеспечивающей системные вызовы и основные функции glibc, позволяющая нарушителю вызвать отказ в обслуживании или внедрение кода
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PReferences
MEDIUM5.9
Уязвимость утилиты iconv системной библиотеки GNU C Library (glibc), связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xMEDIUM 5.9
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS 2.0MEDIUM 5.4
CVSS:2.0/AV:N/AC:H/Au:N/C:N/I:N/A:CReferences
CRITICAL9.8
nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
- http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
- http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
- http://seclists.org/fulldisclosure/2019/Jun/18
- http://seclists.org/fulldisclosure/2019/Sep/7
- http://www.securityfocus.com/bid/99071
- https://seclists.org/bugtraq/2019/Jun/14
- https://seclists.org/bugtraq/2019/Sep/7
- https://sourceware.org/bugzilla/show_bug.cgi?id=16695
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=c44496df2f090a56d3bf75df930592dac6bba46f
- http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
- http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
- http://seclists.org/fulldisclosure/2019/Jun/18
- http://seclists.org/fulldisclosure/2019/Sep/7
- http://www.securityfocus.com/bid/99071
- https://seclists.org/bugtraq/2019/Jun/14
- https://seclists.org/bugtraq/2019/Sep/7
- https://sourceware.org/bugzilla/show_bug.cgi?id=16695
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=c44496df2f090a56d3bf75df930592dac6bba46f
HIGH7.5
res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash).
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
- http://www.securityfocus.com/bid/99324
- http://www.ubuntu.com/usn/USN-3239-1
- http://www.ubuntu.com/usn/USN-3239-2
- https://access.redhat.com/errata/RHSA-2018:0805
- https://bugzilla.redhat.com/show_bug.cgi?id=1249603
- https://security.gentoo.org/glsa/201706-19
- https://sourceware.org/bugzilla/attachment.cgi?id=8492
- https://sourceware.org/bugzilla/show_bug.cgi?id=18784
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5
- https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- http://www.securityfocus.com/bid/99324
- http://www.ubuntu.com/usn/USN-3239-1
- http://www.ubuntu.com/usn/USN-3239-2
- https://access.redhat.com/errata/RHSA-2018:0805
- https://bugzilla.redhat.com/show_bug.cgi?id=1249603
- https://security.gentoo.org/glsa/201706-19
- https://sourceware.org/bugzilla/attachment.cgi?id=8492
- https://sourceware.org/bugzilla/show_bug.cgi?id=18784
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=fc82b0a2dfe7dbd35671c10510a8da1043d746a5
- https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
HIGH8.1
Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
- http://www.openwall.com/lists/oss-security/2015/02/13/3
- http://www.openwall.com/lists/oss-security/2017/02/14/9
- http://www.securityfocus.com/bid/72602
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://sourceware.org/bugzilla/show_bug.cgi?id=16009
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=0f9e585480ed
- http://www.openwall.com/lists/oss-security/2015/02/13/3
- http://www.openwall.com/lists/oss-security/2017/02/14/9
- http://www.securityfocus.com/bid/72602
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://sourceware.org/bugzilla/show_bug.cgi?id=16009
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=0f9e585480ed
HIGH8.1
Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
- http://www.openwall.com/lists/oss-security/2017/02/14/9
- http://www.securityfocus.com/bid/72740
- https://sourceware.org/bugzilla/show_bug.cgi?id=17269
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=bdf1ff052a8e23d637f2c838fa5642d78fcedc33
- https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html
- http://www.openwall.com/lists/oss-security/2017/02/14/9
- http://www.securityfocus.com/bid/72740
- https://sourceware.org/bugzilla/show_bug.cgi?id=17269
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=bdf1ff052a8e23d637f2c838fa5642d78fcedc33
- https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html
MEDIUM5.9
The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
- http://www.openwall.com/lists/oss-security/2015/02/26/5
- http://www.openwall.com/lists/oss-security/2017/02/14/9
- http://www.securityfocus.com/bid/72789
- https://sourceware.org/bugzilla/show_bug.cgi?id=18032
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4a28f4d55a6cc33474c0792fe93b5942d81bf185
- https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html
- http://www.openwall.com/lists/oss-security/2015/02/26/5
- http://www.openwall.com/lists/oss-security/2017/02/14/9
- http://www.securityfocus.com/bid/72789
- https://sourceware.org/bugzilla/show_bug.cgi?id=18032
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4a28f4d55a6cc33474c0792fe93b5942d81bf185
- https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html
MEDIUM5.9
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
- http://openwall.com/lists/oss-security/2017/03/01/10
- http://www.securityfocus.com/bid/96525
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://security.gentoo.org/glsa/202101-20
- https://sourceware.org/bugzilla/show_bug.cgi?id=19519
- https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21
- https://sourceware.org/bugzilla/show_bug.cgi?id=26224
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://openwall.com/lists/oss-security/2017/03/01/10
- http://www.securityfocus.com/bid/96525
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://security.gentoo.org/glsa/202101-20
- https://sourceware.org/bugzilla/show_bug.cgi?id=19519
- https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21
- https://sourceware.org/bugzilla/show_bug.cgi?id=26224
- https://www.oracle.com/security-alerts/cpuapr2022.html
HIGH7.5
Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.24 allows remote attackers to cause a denial of service (memory consumption) by leveraging partial initialization of internal resolver data structures.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
- http://www.openwall.com/lists/oss-security/2016/08/02/5
- http://www.securityfocus.com/bid/92257
- https://sourceware.org/bugzilla/show_bug.cgi?id=19257
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=2212c1420c92a33b0e0bd9a34938c9814a56c0f7
- https://www.sourceware.org/ml/libc-alpha/2016-08/msg00212.html
- http://www.openwall.com/lists/oss-security/2016/08/02/5
- http://www.securityfocus.com/bid/92257
- https://sourceware.org/bugzilla/show_bug.cgi?id=19257
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=2212c1420c92a33b0e0bd9a34938c9814a56c0f7
- https://www.sourceware.org/ml/libc-alpha/2016-08/msg00212.html