Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibcUpgrade glibc-commonUpgrade glibc-develUpgrade glibc-utilsUpgrade glibc-staticUpgrade nscdUpgrade glibc-headers | Dec 1, 2016 | Jul 29, 2014 |
| Debian | — | Upgrade eglibcUpgrade glibc | Jul 30, 2024 | Jul 29, 2014 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Jul 29, 2014 |
| Oracle_linux | — | Upgrade glibc-commonUpgrade glibc-develUpgrade glibc-utilsUpgrade nscdUpgrade glibc-headersUpgrade glibcUpgrade glibc-static | Oct 16, 2024 | Jul 29, 2014 |
| Suse | — | Upgrade nscdUpgrade glibc-utilsUpgrade glibc-devel-32bitUpgrade glibc-extraUpgrade glibc-htmlUpgrade glibc-infoUpgrade glibc-locale-x86Upgrade glibc-32bitUpgrade glibc-locale-baseUpgrade glibc-x86Upgrade glibc-profile-32bitUpgrade glibcUpgrade glibc-localeUpgrade glibc-i18ndataUpgrade glibc-locale-32bitUpgrade glibc-devel-staticUpgrade glibc-develUpgrade glibc-profileUpgrade glibc-profile-x86 | Dec 18, 2015 | Jul 29, 2014 |
| Ubuntu | — | Upgrade libc6 | Nov 8, 2024 | Jul 29, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub