CVE-2015-1781

Published: Sep 28, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.

Affected (12)

Products: Suse: Linux Enterprise Debuginfo, Linux Enterprise Desktop, Linux Enterprise Server · Gnu: Glibc · Debian: Debian Linux · +1 more

Show all products

Suse: Linux Enterprise Debuginfo, Linux Enterprise Desktop, Linux Enterprise Server · Gnu: Glibc · Debian: Debian Linux · Canonical: Ubuntu Linux

3 products

Linux Enterprise Debuginfo

Linux Enterprise Desktop

Linux Enterprise Server

1 product

1 product

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise Debuginfo	Version 11 sp3
Suse Linux Enterprise Debuginfo	Version 11 sp4
Suse Linux Enterprise Desktop	Version 11 sp3
Suse Linux Enterprise Desktop	Version 11 sp4
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Glibc	Up to 2.21

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.04

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (28)

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.debian.org/security/2016/dsa-3480

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/74255

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1032178

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2985-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2985-2

Source: secalert@redhat.com

Third Party Advisory

https://rhn.redhat.com/errata/RHSA-2015-0863.html

Source: secalert@redhat.com

Third Party Advisory

https://security.gentoo.org/glsa/201602-02

Source: secalert@redhat.com

Third Party Advisory

https://sourceware.org/bugzilla/show_bug.cgi?id=18287

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=2959eda9272a03386

Source: secalert@redhat.com

https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.debian.org/security/2016/dsa-3480

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/74255

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1032178

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2985-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.ubuntu.com/usn/USN-2985-2

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://rhn.redhat.com/errata/RHSA-2015-0863.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.gentoo.org/glsa/201602-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://sourceware.org/bugzilla/show_bug.cgi?id=18287

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=2959eda9272a03386

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.