CVE-2015-0235

Published: Jan 28, 2015Modified: May 6, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

Affected (33)

Products: Gnu: Glibc · Oracle: Communications Application Session Controller, Communications Eagle Application Processor, Communications Eagle Lnp Application Processor, Communications Lsms, Communications Policy Management, Communications Session Border Controller, Communications User Data Repository, Communications Webrtc Session Controller, Exalogic Infrastructure, Linux, Vm Virtualbox · Debian: Debian Linux · +4 more

Show all products

Gnu

1 product

Glibc

Oracle

11 products

Communications Application Session Controller

Communications Eagle Application Processor

Communications Eagle Lnp Application Processor

Communications Lsms

Communications Policy Management

Communications Session Border Controller

Communications User Data Repository

Communications Webrtc Session Controller

Exalogic Infrastructure

1 product

1 product

1 product

2 products

Pureapplication System

Security Access Manager For Enterprise Single Sign On

Php

1 product

Php

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Glibc	From 2.0 to 2.18

Configuration B

21 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Application Session Controller	Before 3.7.1
Oracle Communications Eagle Application Processor	Version 16.0
Oracle Communications Eagle Lnp Application Processor	Version 10.0
Oracle Communications Lsms	Version 13.1
Oracle Communications Policy Management	Version 10.4.1
Oracle Communications Policy Management	Version 11.5
Oracle Communications Policy Management	Version 12.1.1
Oracle Communications Policy Management	Version 9.7.3
Oracle Communications Policy Management	Version 9.9.1
Oracle Communications Session Border Controller	Before 7.2.0
Oracle Communications Session Border Controller	Version 7.2.0
Oracle Communications Session Border Controller	Version 8.0.0
Oracle Communications User Data Repository	From 10.0.0 to 10.0.1
Oracle Communications Webrtc Session Controller	Version 7.0
Oracle Communications Webrtc Session Controller	Version 7.1
Oracle Communications Webrtc Session Controller	Version 7.2
Oracle Exalogic Infrastructure	Version 1.0
Oracle Exalogic Infrastructure	Version 2.0
Oracle Linux	Version 5
Oracle Linux	Version 7 0
Oracle Vm Virtualbox	Before 5.1.24

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Virtualization	Version 6.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Before 10.11.1

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
Ibm Pureapplication System	Version 1.0.0.0
Ibm Pureapplication System	Version 1.1.0.0
Ibm Pureapplication System	Version 2.0.0.0
Ibm Security Access Manager For Enterprise Single Sign On	Version 8.2

Configuration G

3 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 5.4.0 to 5.4.38
Php Php	From 5.5.0 to 5.5.22
Php Php	From 5.6.0 to 5.6.6

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (180)

http://blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/

Source: secalert@redhat.com

Third Party Advisory

http://linux.oracle.com/errata/ELSA-2015-0090.html

Source: secalert@redhat.com

Third Party Advisory

http://linux.oracle.com/errata/ELSA-2015-0092.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142296726407499&w=2

Source: secalert@redhat.com

Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142721102728110&w=2

Source: secalert@redhat.com

Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142722450701342&w=2

Source: secalert@redhat.com

Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142781412222323&w=2

Source: secalert@redhat.com

Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=143145428124857&w=2

Source: secalert@redhat.com

Issue TrackingMailing ListThird Party Advisory

http://packetstormsecurity.com/files/130171/Exim-ESMTP-GHOST-Denial-Of-Service.html

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/130974/Exim-GHOST-glibc-gethostbyname-Buffer-Overflow.html

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://rhn.redhat.com/errata/RHSA-2015-0126.html

Source: secalert@redhat.com

Third Party Advisory

http://seclists.org/fulldisclosure/2015/Jan/111

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2019/Jun/18

Source: secalert@redhat.com

ExploitMailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2021/Sep/0

Source: secalert@redhat.com

ExploitMailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Jun/36

Source: secalert@redhat.com

ExploitMailing ListThird Party Advisory

http://seclists.org/oss-sec/2015/q1/269

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/oss-sec/2015/q1/274

Source: secalert@redhat.com

ExploitMailing ListThird Party Advisory

http://secunia.com/advisories/62517

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62640

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62667

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62680

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62681

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62688

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62690

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62691

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62692

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62698

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62715

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62758

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62812

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62813

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62816

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62865

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62870

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62871

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62879

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/62883

Source: secalert@redhat.com

Not Applicable

http://support.apple.com/kb/HT204942

Source: secalert@redhat.com

Third Party Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-ghost

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21695695

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21695774

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21695835

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21695860

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696131

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696243

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696526

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696600

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696602

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696618

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2015/dsa-3142

Source: secalert@redhat.com

Third Party Advisory

http://www.idirect.net/Partners/~/media/Files/CVE/iDirect-Posted-Common-Vulnerabilities-and-Exposures.pdf

Source: secalert@redhat.com

Broken LinkURL Repurposed

http://www.mandriva.com/security/advisories?name=MDVSA-2015:039

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/04/7

Source: secalert@redhat.com

ExploitMailing List

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/534845/100/0/threaded

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/72325

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1032909

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0

Source: secalert@redhat.com

Broken LinkPermissions Required

https://bto.bluecoat.com/security-advisory/sa90

Source: secalert@redhat.com

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-994726.pdf

Source: secalert@redhat.com

Third Party Advisory

https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability

Source: secalert@redhat.com

Third Party Advisory

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04874668

Source: secalert@redhat.com

Third Party Advisory

https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes

Source: secalert@redhat.com

Third Party Advisory

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10671

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10100

Source: secalert@redhat.com

Third Party Advisory

https://seclists.org/bugtraq/2019/Jun/14

Source: secalert@redhat.com

ExploitMailing ListThird Party Advisory

https://security.gentoo.org/glsa/201503-04

Source: secalert@redhat.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20150127-0001/

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/HT205267

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/HT205375

Source: secalert@redhat.com

Third Party Advisory

https://www.arista.com/en/support/advisories-notices/security-advisories/1053-security-advisory-9

Source: secalert@redhat.com

Third Party Advisory

https://www.f-secure.com/en/web/labs_global/fsc-2015-1

Source: secalert@redhat.com

Third Party Advisory

https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt

Source: secalert@redhat.com

Third Party Advisory

https://www.sophos.com/en-us/support/knowledgebase/121879.aspx

Source: secalert@redhat.com

Third Party Advisory

http://blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/