Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-utilsUpgrade glibc-commonUpgrade glibc-headersUpgrade glibcUpgrade glibc-develUpgrade nscdUpgrade glibc-static | Dec 1, 2016 | Sep 28, 2015 |
| Debian | — | Upgrade glibcUpgrade eglibc | Feb 17, 2016 | Sep 28, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jul 8, 2015 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Sep 28, 2015 |
| Oracle_linux | — | Upgrade glibc-staticUpgrade glibc-develUpgrade glibc-utilsUpgrade nscdUpgrade glibc-headersUpgrade glibc-commonUpgrade glibc | Oct 16, 2024 | Sep 28, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 21, 2015 |
| Suse | — | Upgrade glibc-devel-32bitUpgrade glibc-develUpgrade glibc-locale-baseUpgrade glibc-i18ndataUpgrade glibc-htmlUpgrade glibc-localeUpgrade glibc-locale-x86Upgrade glibc-utilsUpgrade glibc-devel-staticUpgrade glibc-langUpgrade glibc-extraUpgrade glibc-profileUpgrade glibc-locale-base-32bitUpgrade glibc-infoUpgrade glibc-32bitUpgrade glibc-profile-x86Upgrade glibc-x86Upgrade nscdUpgrade glibc-locale-32bitUpgrade glibcUpgrade glibc-profile-32bit | Dec 18, 2015 | Aug 21, 2015 |
| Ubuntu | — | Upgrade libc6-devUpgrade libc6 | May 27, 2016 | Sep 28, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub