Login Request a demo
Unscored severity · published Jan 28, 2015
CVE-2015-0235
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary…
–
CVSS
94.6%
EPSS
No
On KEV
Description
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
Exploitation
Is it being used?
Exploit prediction (EPSS)94.6% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
5.4.0 before 5.4.38; 5.5.0 before 5.5.22; 5.6.0 before 5.6.6 · source: NVD
CA
Communications Application Session Controller · Oracle
before 3.7.1 · source: NVD
CE
Communications Eagle Application Processor · Oracle
16.0 · source: NVD
CE
Communications Eagle Lnp Application Processor · Oracle
10.0 · source: NVD
CL
Communications Lsms · Oracle
13.1 · source: NVD
CP
Communications Policy Management · Oracle
9.7.3; 9.9.1; 10.4.1; 11.5; 12.1.1 · source: NVD
CS
Communications Session Border Controller · Oracle
before 7.2.0; 7.2.0; 8.0.0 · source: NVD
CU
Communications User Data Repository · Oracle
10.0.0 through 10.0.1 · source: NVD
CW
Communications Webrtc Session Controller · Oracle
7.0; 7.1; 7.2 · source: NVD
DL
Debian Linux · Debian
7.0; 8.0 · source: NVD
EI
Exalogic Infrastructure · Oracle
1.0; 2.0 · source: NVD
GL
Glibc · Gnu
2.0 before 2.18 · source: NVD
Affected product
PH
PHP
PHP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0235
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0235
Third Party Advisory
http://blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/
Third Party Advisory
http://linux.oracle.com/errata/ELSA-2015-0090.html
Third Party Advisory
http://linux.oracle.com/errata/ELSA-2015-0092.html
Mailing List
http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
Mailing List
http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
Mailing List
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability