Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade glibcUpgrade eglibc | Jul 30, 2024 | Mar 15, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Apr 18, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade glibc-staticUpgrade glibc-utilsUpgrade glibc-develUpgrade glibc-commonUpgrade glibc-headersUpgrade nscdUpgrade glibc | Jul 23, 2019 | Mar 15, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade glibc-develUpgrade glibcUpgrade glibc-commonUpgrade nscdUpgrade glibc-headersUpgrade glibc-utilsUpgrade glibc-static | Sep 25, 2019 | Mar 15, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade glibc-headersUpgrade nscdUpgrade glibc-utilsUpgrade glibc-commonUpgrade glibc-staticUpgrade glibc-develUpgrade glibc | Jun 27, 2019 | Mar 15, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 13, 2015 |
| Suse | — | Upgrade glibc-profile-32bitUpgrade glibc-devel-32bitUpgrade glibc-i18ndataUpgrade glibcUpgrade glibc-htmlUpgrade glibc-32bitUpgrade glibc-develUpgrade glibc-localeUpgrade glibc-infoUpgrade nscdUpgrade glibc-locale-32bitUpgrade glibc-profile | Mar 22, 2022 | Mar 15, 2017 |
| Ubuntu | — | Upgrade libc6 | Mar 21, 2017 | Mar 15, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub