The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade glibcUpgrade eglibc | Jul 30, 2024 | Apr 8, 2015 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Apr 8, 2015 |
| Oracle_linux | — | Upgrade glibc-utilsUpgrade glibc-develUpgrade glibcUpgrade glibc-commonUpgrade glibc-staticUpgrade nscdUpgrade glibc-headers | Oct 16, 2024 | Apr 8, 2015 |
| Suse | — | Upgrade pam-modules-32bitUpgrade pwdutils-plugin-auditUpgrade glibc-htmlUpgrade glibc-langUpgrade glibc-devel-staticUpgrade glibc-utilsUpgrade glibc-locale-32bitUpgrade glibc-x86Upgrade glibc-extraUpgrade glibc-profile-x86Upgrade glibc-locale-baseUpgrade libxcrypt-32bitUpgrade glibc-localeUpgrade glibcUpgrade pwdutilsUpgrade glibc-devel-32bitUpgrade glibc-locale-base-32bitUpgrade nscdUpgrade glibc-profile-32bitUpgrade glibc-i18ndataUpgrade glibc-profileUpgrade glibc-locale-x86Upgrade glibc-32bitUpgrade pam-modulesUpgrade glibc-infoUpgrade glibc-develUpgrade libxcrypt | Dec 18, 2015 | Mar 5, 2015 |
| Ubuntu | — | Upgrade libc6 | Nov 8, 2024 | Apr 8, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub