Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-profileUpgrade glibc-commonUpgrade nptl-develUpgrade glibc-staticUpgrade glibc-develUpgrade glibc-headersUpgrade glibc-utilsUpgrade nscdUpgrade glibc | Dec 1, 2016 | May 2, 2013 |
| Debian | — | Upgrade glibc | Jul 30, 2024 | May 2, 2013 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | May 2, 2013 |
| Oracle_linux | — | Upgrade glibc-commonUpgrade glibc-headersUpgrade glibc-utilsUpgrade glibc-develUpgrade nscdUpgrade glibc | Oct 16, 2024 | May 2, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 1, 2009 |
| Suse | — | Upgrade glibc-develUpgrade glibc-32bitUpgrade glibc-gconv-modules-extraUpgrade glibc-profileUpgrade glibc-devel-staticUpgrade glibc-extraUpgrade glibc-localeUpgrade glibc-locale-x86Upgrade glibc-x86Upgrade glibc-i18ndataUpgrade nscdUpgrade glibc-langUpgrade glibc-htmlUpgrade glibc-profile-x86Upgrade glibc-utilsUpgrade glibc-locale-baseUpgrade glibc-infoUpgrade glibc-locale-32bitUpgrade glibc-profile-32bitUpgrade glibcUpgrade glibc-devel-32bit | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libc-binUpgrade libc6 | Nov 8, 2024 | May 2, 2013 |
| Vmsa 2012 0013 | — | Upgrade VMware ESX 4.1 to build number 800380 | Sep 17, 2012 | Sep 17, 2012 |
| Vmsa 2012 0018 | — | Upgrade VMware ESXi 5.1 to build number 911593Upgrade VMware ESXi 5.0 to build number 912577 | Jan 4, 2013 | Jan 4, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub