The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade eglibcUpgrade glibc | Jul 30, 2024 | Oct 6, 2014 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Oct 6, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade glibc-commonUpgrade glibc-headersUpgrade glibcUpgrade glibc-utilsUpgrade glibc-staticUpgrade glibc-develUpgrade nscd | Jul 23, 2019 | Oct 6, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade glibcUpgrade glibc-staticUpgrade glibc-develUpgrade glibc-utilsUpgrade glibc-headersUpgrade glibc-commonUpgrade nscd | Sep 25, 2019 | Oct 6, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade glibc-utilsUpgrade glibc-staticUpgrade glibc-commonUpgrade nscdUpgrade glibc-headersUpgrade glibc-develUpgrade glibc | Jun 27, 2019 | Oct 6, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 11, 2014 |
| Suse | — | Upgrade pwdutils-plugin-auditUpgrade pam-modules-32bitUpgrade glibc-extraUpgrade pwdutilsUpgrade libxcrypt-32bitUpgrade glibc-utilsUpgrade glibc-htmlUpgrade glibc-locale-32bitUpgrade glibc-32bitUpgrade glibc-x86Upgrade glibc-infoUpgrade nscdUpgrade glibc-devel-32bitUpgrade glibc-profile-32bitUpgrade pam-modulesUpgrade glibc-profileUpgrade glibc-locale-x86Upgrade glibc-devel-staticUpgrade glibc-profile-x86Upgrade glibc-i18ndataUpgrade glibc-develUpgrade libxcryptUpgrade glibc-locale-baseUpgrade glibcUpgrade glibc-locale | Dec 18, 2015 | Jul 18, 2014 |
| Ubuntu | — | Upgrade libc6 | Nov 8, 2024 | Oct 6, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub