Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-commonUpgrade glibc-headersUpgrade glibc-profileUpgrade glibc-utilsUpgrade glibc-develUpgrade glibc-staticUpgrade nptl-develUpgrade nscdUpgrade glibc | Dec 1, 2016 | May 2, 2013 |
| Debian | — | Upgrade glibc | Jul 30, 2024 | May 2, 2013 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | May 2, 2013 |
| Oracle_linux | — | Upgrade glibc-headersUpgrade glibc-develUpgrade glibc-commonUpgrade glibc-utilsUpgrade glibcUpgrade nscd | Oct 16, 2024 | May 2, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 1, 2009 |
| Suse | — | Upgrade glibc-locale-32bitUpgrade glibc-profile-x86Upgrade glibc-devel-32bitUpgrade nscdUpgrade glibcUpgrade glibc-langUpgrade glibc-htmlUpgrade glibc-profile-32bitUpgrade glibc-utilsUpgrade glibc-infoUpgrade glibc-locale-baseUpgrade glibc-32bitUpgrade glibc-localeUpgrade glibc-extraUpgrade glibc-profileUpgrade glibc-gconv-modules-extraUpgrade glibc-i18ndataUpgrade glibc-locale-x86Upgrade glibc-devel-staticUpgrade glibc-x86Upgrade glibc-devel | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libc6Upgrade libc-bin | Nov 8, 2024 | May 2, 2013 |
| Vmsa 2012 0013 | — | Upgrade VMware ESX 4.1 to build number 800380 | Sep 17, 2012 | Sep 17, 2012 |
| Vmsa 2012 0018 | — | Upgrade VMware ESXi 5.1 to build number 911593Upgrade VMware ESXi 5.0 to build number 912577 | Jan 4, 2013 | Jan 4, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub