Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-utilsUpgrade glibc-develUpgrade glibc-staticUpgrade glibc-commonUpgrade glibcUpgrade nscdUpgrade glibc-headers | Dec 1, 2016 | Jul 29, 2014 |
| Debian | — | Upgrade eglibcUpgrade glibc | Jul 30, 2024 | Jul 29, 2014 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Jul 29, 2014 |
| Oracle_linux | — | Upgrade glibc-headersUpgrade glibcUpgrade nscdUpgrade glibc-staticUpgrade glibc-develUpgrade glibc-utilsUpgrade glibc-common | Oct 16, 2024 | Jul 29, 2014 |
| Suse | — | Upgrade glibcUpgrade glibc-profileUpgrade glibc-develUpgrade glibc-profile-x86Upgrade glibc-devel-staticUpgrade glibc-locale-32bitUpgrade glibc-localeUpgrade glibc-i18ndataUpgrade glibc-utilsUpgrade glibc-x86Upgrade glibc-locale-baseUpgrade glibc-extraUpgrade glibc-devel-32bitUpgrade glibc-infoUpgrade glibc-32bitUpgrade glibc-profile-32bitUpgrade glibc-locale-x86Upgrade nscdUpgrade glibc-html | Dec 18, 2015 | Jul 29, 2014 |
| Ubuntu | — | Upgrade libc6 | Nov 8, 2024 | Jul 29, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub