The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-profileUpgrade glibc-headersUpgrade glibc-develUpgrade glibcUpgrade glibc-commonUpgrade glibc-utilsUpgrade nscdUpgrade nptl-devel | Dec 1, 2016 | Apr 8, 2011 |
| Debian | — | Upgrade glibc | Jul 30, 2024 | Apr 8, 2011 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jun 13, 2015 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Apr 8, 2011 |
| Oracle_linux | — | Upgrade glibc-commonUpgrade glibc-utilsUpgrade glibc-develUpgrade glibc-headersUpgrade nscdUpgrade glibc | Oct 16, 2024 | Apr 8, 2011 |
| Suse | — | Upgrade glibc-64bitUpgrade glibc-profileUpgrade glibc-dceextUpgrade glibc-profile-32bitUpgrade glibc-32bitUpgrade glibc-devel-64bitUpgrade glibc-locale-x86Upgrade timezoneUpgrade glibc-dceext-64bitUpgrade nscdUpgrade glibc-infoUpgrade glibc-devel-32bitUpgrade glibc-profile-64bitUpgrade glibc-locale-32bitUpgrade glibc-localeUpgrade glibc-develUpgrade glibc-locale-64bitUpgrade glibc-profile-x86Upgrade glibcUpgrade glibc-x86Upgrade glibc-htmlUpgrade sap-aio-releaseUpgrade glibc-i18ndataUpgrade glibc-dceext-32bitUpgrade glibc-dceext-x86 | Dec 12, 2013 | Apr 8, 2011 |
| Ubuntu | — | Upgrade libc6Upgrade libc-bin | Nov 8, 2024 | Apr 8, 2011 |
| Vmsa 2011 0010 | — | Upgrade VMware ESX 4.0 to build number 480973Upgrade VMware ESX 4.1 to build number 433742 | Aug 2, 2011 | Jul 28, 2011 |
| Vmsa 2011 0012 | — | Upgrade VMware ESX 4.0 to build number 480973Upgrade VMware ESXi 5.0 to build number 515841Upgrade VMware ESX 4.1 to build number 502767Upgrade VMware ESXi 4.1 to build number 502767Upgrade VMware ESXi 4.0 to build number 480973 | Oct 20, 2011 | Apr 8, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub