The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade glibc | Dec 7, 2018 | Dec 17, 2017 |
| Centos_linux | — | Upgrade glibc-staticUpgrade glibc-utilsUpgrade glibc-commonUpgrade glibc-debuginfoUpgrade glibc-headersUpgrade nscdUpgrade glibcUpgrade glibc-develUpgrade glibc-debuginfo-common | Aug 28, 2019 | Dec 18, 2017 |
| Debian | — | Upgrade glibc | Jul 30, 2024 | Dec 18, 2017 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Apr 5, 2018 | Dec 17, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade glibc-headersUpgrade glibcUpgrade nscdUpgrade glibc-staticUpgrade glibc-develUpgrade glibc-commonUpgrade glibc-utils | Jun 27, 2019 | Dec 18, 2017 |
| Oracle_linux | — | Upgrade glibcUpgrade glibc-commonUpgrade glibc-utilsUpgrade glibc-develUpgrade nscdUpgrade glibc-headersUpgrade glibc-static | Nov 6, 2018 | Dec 17, 2017 |
| Redhat_linux | — | Upgrade glibc-staticUpgrade glibcUpgrade nscdUpgrade glibc-headersUpgrade glibc-debuginfoUpgrade glibc-commonUpgrade glibc-utilsUpgrade glibc-develUpgrade glibc-debuginfo-commonNo solution exists | Oct 31, 2018 | Dec 17, 2017 |
| Suse | — | Upgrade glibcUpgrade glibc-profile-32bitUpgrade glibc-locale-base-32bitUpgrade glibc-devel-32bitUpgrade glibc-utilsUpgrade nscdUpgrade glibc-infoUpgrade glibc-langUpgrade glibc-htmlUpgrade glibc-locale-baseUpgrade glibc-locale-32bitUpgrade glibc-localeUpgrade glibc-develUpgrade glibc-i18ndataUpgrade glibc-devel-staticUpgrade glibc-profileUpgrade glibc-32bitUpgrade glibc-extra | Jan 13, 2018 | Dec 17, 2017 |
| Ubuntu | — | Upgrade libc6 | Jan 18, 2018 | Dec 17, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 18, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub