DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade eglibcUpgrade glibc | Feb 17, 2016 | Mar 27, 2015 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Mar 27, 2015 |
| Oracle_linux | — | Upgrade glibcUpgrade glibc-develUpgrade glibc-utilsUpgrade glibc-headersUpgrade glibc-staticUpgrade glibc-commonUpgrade nscd | Oct 16, 2024 | Mar 27, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 23, 2015 |
| Suse | — | Upgrade nscdUpgrade glibc-locale-baseUpgrade glibc-locale-32bitUpgrade glibc-htmlUpgrade glibcUpgrade glibc-langUpgrade glibc-32bitUpgrade glibc-extraUpgrade glibc-devel-32bitUpgrade glibc-infoUpgrade glibc-profile-32bitUpgrade glibc-locale-base-32bitUpgrade glibc-utilsUpgrade glibc-localeUpgrade glibc-devel-staticUpgrade glibc-locale-x86Upgrade glibc-profile-x86Upgrade glibc-x86Upgrade glibc-profileUpgrade glibc-develUpgrade glibc-i18ndata | Dec 18, 2015 | Mar 27, 2015 |
| Ubuntu | — | Upgrade libc6Upgrade libc6-dev | May 27, 2016 | Mar 27, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub