Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade glibcUpgrade eglibc | Jul 30, 2024 | Mar 15, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Apr 18, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade glibcUpgrade nscdUpgrade glibc-utilsUpgrade glibc-develUpgrade glibc-staticUpgrade glibc-headersUpgrade glibc-common | Jul 23, 2019 | Mar 15, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade glibc-utilsUpgrade glibcUpgrade glibc-headersUpgrade glibc-commonUpgrade glibc-staticUpgrade nscdUpgrade glibc-devel | Sep 25, 2019 | Mar 15, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade glibc-staticUpgrade glibc-develUpgrade glibcUpgrade glibc-headersUpgrade glibc-utilsUpgrade nscdUpgrade glibc-common | Jun 27, 2019 | Mar 15, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 13, 2015 |
| Suse | — | Upgrade glibc-localeUpgrade glibc-develUpgrade glibc-htmlUpgrade glibcUpgrade glibc-32bitUpgrade glibc-i18ndataUpgrade glibc-infoUpgrade glibc-devel-32bitUpgrade glibc-profile-32bitUpgrade glibc-profileUpgrade nscdUpgrade glibc-locale-32bit | Mar 22, 2022 | Mar 15, 2017 |
| Ubuntu | — | Upgrade libc6 | Mar 21, 2017 | Mar 15, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub