GL
Product
Glibc
On CISA KEVExploited in the wild
163
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 22High 47Medium 31Low 2
Watch
Add Glibc to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-5450 | 9.8 | Apr 20 | scanf %mc off-by-one heap buffer overflow Affected: 2.7 through 2.43 |
| CVE-2023-0687 | 9.8 | Feb 6 | A vulnerability was found in GNU C Library 2.38 Affected: before 2.38 |
| CVE-2023-25139 | 9.8 | Feb 3 | sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size Affected: 2.37 |
| CVE-2022-23218 | 9.8 | Jan 14 | The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating… Affected: before 2.31 |
| CVE-2022-23219 | 9.8 | Jan 14 | The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating… Affected: before 2.31 |
| CVE-2021-33574 | 9.8 | May 25 | The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free Affected: 2.32; 2.33 |
| CVE-1999-0199 | 9.8 | Oct 6 | manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow… Affected: before 2.2 |
| CVE-2019-1010022 | 9.8 | Jul 15 | GNU Libc current is affected by: Mitigation bypass Affected: All versions, or not specified |
| CVE-2005-3590 | 9.8 | Apr 10 | The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is… Affected: before 2.3.5 |
| CVE-2019-9169 | 9.8 | Feb 26 | In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression… Affected: through 2.29 |
| CVE-2018-11236 | 9.8 | May 18 | stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer… Affected: through 2.27 |
| CVE-2017-18269 | 9.8 | May 18 | An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not… Affected: 2.21 through 2.27 |
| CVE-2018-6551 | 9.8 | Feb 2 | The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls… Affected: 2.24 through 2.26 |
| CVE-2018-6485 | 9.8 | Feb 1 | An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to… Affected: through 2.26 |
| CVE-2017-15804 | 9.8 | Oct 22 | The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator Affected: through 2.26 |
| CVE-2017-15670 | 9.8 | Oct 20 | The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing… Affected: through 2.26 |
| CVE-2014-9984 | 9.8 | Jun 12 | nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to… Affected: through 2.19 |
| CVE-2015-8779 | 9.8 | Apr 19 | Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service… Affected: through 2.22 |
| CVE-2015-8778 | 9.8 | Apr 19 | Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute… Affected: through 2.22 |
| CVE-2014-9761 | 9.8 | Apr 19 | Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or… Affected: through 2.22 |
| CVE-2021-35942 | 9.1 | Jul 22 | The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted… Affected: before 2.31 |
| CVE-2015-8776 | 9.1 | Apr 19 | The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain… Affected: through 2.22 |
Showing 22