GL
Product
Glibc
On CISA KEVExploited in the wild
163
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 22High 47Medium 31Low 2
Watch
Add Glibc to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-19126 | 3.3 | Nov 19 | On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security… Affected: before 2.31 |
| CVE-2021-27645 | 2.5 | Feb 24 | The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free,… Affected: 2.29 through 2.33 |
| CVE-2015-5277 | – | Dec 17 | The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of… Affected: through 2.19 |
| CVE-2015-1781 | – | Sep 28 | Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a… Affected: through 2.21 |
| CVE-2013-7424 | – | Aug 26 | The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid… Affected: through 2.14.1 |
| CVE-2015-1473 | – | Apr 8 | The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use… Affected: through 2.20 |
| CVE-2015-1472 | – | Apr 8 | The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows… Affected: through 2.20 |
| CVE-2014-8121 | – | Mar 27 | DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows… Affected: through 2.21 |
| CVE-2014-9402 | – | Feb 24 | The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote… Affected: through 2.20 |
| CVE-2013-7423 | – | Feb 24 | The send_dg function in resolv/res_send.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS… Affected: before 2.20 |
| CVE-2015-0235 | – | Jan 28 | Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary… Affected: 2.0 before 2.18 |
| CVE-2014-6040 | – | Dec 5 | GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to… Affected: through 2.19; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +23 more |
| CVE-2012-6656 | – | Dec 5 | iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of… Affected: through 2.16 |
| CVE-2014-7817 | – | Nov 24 | The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as… Affected: 2.21 |
| CVE-2011-2702 | – | Oct 27 | Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows context-dependent attackers… Affected: through 2.12.2; 2.12; 2.12.1 |
| CVE-2014-4043 | – | Oct 6 | The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent… Affected: through 2.19 |
| CVE-2014-5119 | – | Aug 29 | Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or… Affected: before 2.20 |
| CVE-2014-0475 | – | Jul 29 | Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly… Affected: through 2.19; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +23 more |
| CVE-2012-3406 | – | Feb 10 | The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function… Affected: 2.5; 2.12 |
| CVE-2012-3405 | – | Feb 10 | The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows… Affected: 2.14 |
| CVE-2012-3404 | – | Feb 10 | The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows… Affected: 2.12 |
| CVE-2013-4458 | – | Dec 12 | Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a… Affected: through 2.18; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +21 more |
| CVE-2013-4332 | – | Oct 9 | Multiple integer overflows in malloc/malloc.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allow context-dependent attackers to cause a denial of service (heap… Affected: through 2.18; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +21 more |
| CVE-2013-4237 | – | Oct 9 | sysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and… Affected: through 2.18; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +21 more |
| CVE-2013-2207 | – | Oct 9 | pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and… Affected: through 2.17; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +20 more |
| CVE-2012-4424 | – | Oct 9 | Stack-based buffer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service… Affected: through 2.17; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +20 more |
| CVE-2012-4412 | – | Oct 9 | Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or… Affected: through 2.17; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +20 more |
| CVE-2013-4788 | – | Oct 4 | The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer… Affected: through 2.17; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +21 more |
| CVE-2012-0864 | – | May 2 | Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection… Affected: 2.14 |
| CVE-2011-4609 | – | May 2 | The svc_run function in the RPC implementation in glibc before 2.15 allows remote attackers to cause a denial of service (CPU consumption) via a large number of RPC connections Affected: through 2.14; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +9 more |
| CVE-2009-5029 | – | May 2 | Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via… Affected: through 2.14; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +9 more |
| CVE-2013-1914 | – | Apr 29 | Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a… Affected: through 2.17; 2.0.1; 2.0.6; 2.2; 2.2.1; 2.2.2; +30 more |
| CVE-2013-0242 | – | Feb 8 | Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause… Affected: 2.17 |
| CVE-2012-3480 | – | Aug 25 | Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related functions" in stdlib in GNU C Library (aka glibc or libc6) 2.16… Affected: 2.16 |
| CVE-2011-1095 | – | Apr 10 | locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted… Affected: through 2.12.2; 1.00; 1.01; 1.02; 1.03; 1.04; +34 more |
| CVE-2011-1089 | – | Apr 10 | The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes… Affected: through 2.13; 1.00; 1.01; 1.02; 1.03; 1.04; +34 more |
| CVE-2011-1659 | – | Apr 8 | Integer overflow in posix/fnmatch.c in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows context-dependent attackers to cause a denial of service (application crash)… Affected: through 2.13; 1.00; 1.01; 1.02; 1.03; 1.04; +34 more |
| CVE-2011-1658 | – | Apr 8 | ld.so in the GNU C Library (aka glibc or libc6) 2.13 and earlier expands the $ORIGIN dynamic string token when RPATH is composed entirely of this token, which might allow local… Affected: through 2.13; 1.00; 1.01; 1.02; 1.03; 1.04; +34 more |
| CVE-2011-1071 | – | Apr 8 | The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory… Affected: through 2.12.1; 1.00; 1.01; 1.02; 1.03; 1.04; +34 more |
| CVE-2011-0536 | – | Apr 8 | Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and… Affected: 2.5-49.el5_5.6; 2.12-1.7.el6_0.3 |
| CVE-2009-5064 | – | Mar 30 | ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits… Affected: through 2.1.3; 1.00; 1.01; 1.02; 1.03; 1.04; +17 more |
| CVE-2010-4756 | – | Mar 2 | The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob… Affected: All versions, or not specified |
| CVE-2010-4052 | – | Jan 13 | Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent… Affected: 1.00; 1.01; 1.02; 1.03; 1.04; 1.05; +22 more |
| CVE-2010-4051 | – | Jan 13 | The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service… Affected: 1.00; 1.01; 1.02; 1.03; 1.04; 1.05; +22 more |
| CVE-2010-3856 | – | Jan 7 | ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic… Affected: through 2.11.2; 1.00; 1.01; 1.02; 1.03; 1.04; +34 more |
| CVE-2010-3847 | – | Jan 7 | elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT… Affected: through 2.11.2; 1.00; 1.01; 1.02; 1.03; 1.04; +34 more |
| CVE-2010-3192 | – | Oct 14 | Certain run-time memory protection mechanisms in the GNU C Library (aka glibc or libc6) print argv[0] and backtrace information, which might allow context-dependent attackers to… Affected: before 2.26 |
| CVE-2010-0830 | – | Jun 1 | Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify… Affected: 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; +32 more |
| CVE-2010-0296 | – | Jun 1 | The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline… Affected: through 2.11.1; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +33 more |
| CVE-2009-4881 | – | Jun 1 | Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent… Affected: through 2.9; 1.00; 1.01; 1.02; 1.03; 1.04; +34 more |