The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-develUpgrade glibcUpgrade glibc-headersUpgrade glibc-profileUpgrade glibc-commonUpgrade nptl-develUpgrade glibc-utilsUpgrade nscd | Dec 1, 2016 | Apr 8, 2011 |
| Debian | — | Upgrade glibc | Jul 30, 2024 | Apr 8, 2011 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jun 13, 2015 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Apr 8, 2011 |
| Oracle_linux | — | Upgrade glibc-commonUpgrade glibc-utilsUpgrade glibc-develUpgrade nscdUpgrade glibcUpgrade glibc-headers | Oct 16, 2024 | Apr 8, 2011 |
| Suse | — | Upgrade glibc-devel-64bitUpgrade glibc-32bitUpgrade glibc-infoUpgrade glibc-64bitUpgrade timezoneUpgrade glibc-profileUpgrade glibc-profile-32bitUpgrade nscdUpgrade glibc-locale-x86Upgrade glibc-dceext-64bitUpgrade glibc-dceextUpgrade glibcUpgrade glibc-i18ndataUpgrade glibc-dceext-x86Upgrade sap-aio-releaseUpgrade glibc-profile-x86Upgrade glibc-x86Upgrade glibc-profile-64bitUpgrade glibc-dceext-32bitUpgrade glibc-develUpgrade glibc-devel-32bitUpgrade glibc-localeUpgrade glibc-locale-64bitUpgrade glibc-htmlUpgrade glibc-locale-32bit | Dec 12, 2013 | Apr 8, 2011 |
| Ubuntu | — | Upgrade libc6Upgrade libc-bin | Nov 8, 2024 | Apr 8, 2011 |
| Vmsa 2011 0010 | — | Upgrade VMware ESX 4.0 to build number 480973Upgrade VMware ESX 4.1 to build number 433742 | Aug 2, 2011 | Jul 28, 2011 |
| Vmsa 2011 0012 | — | Upgrade VMware ESX 4.0 to build number 480973Upgrade VMware ESXi 5.0 to build number 515841Upgrade VMware ESXi 4.1 to build number 502767Upgrade VMware ESX 4.1 to build number 502767Upgrade VMware ESXi 4.0 to build number 480973 | Oct 20, 2011 | Apr 8, 2011 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub