Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-staticUpgrade glibc-develUpgrade glibc-commonUpgrade nptl-develUpgrade glibc-profileUpgrade glibc-utilsUpgrade glibc-headersUpgrade glibcUpgrade nscd | Dec 1, 2016 | May 2, 2013 |
| Debian | — | Upgrade glibc | Jul 30, 2024 | May 2, 2013 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | May 2, 2013 |
| Oracle_linux | — | Upgrade glibcUpgrade nscdUpgrade glibc-commonUpgrade glibc-headersUpgrade glibc-utilsUpgrade glibc-devel | Oct 16, 2024 | May 2, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 1, 2009 |
| Suse | — | Upgrade glibc-utilsUpgrade glibc-devel-static-32bitUpgrade glibc-locale-debuginfoUpgrade glibc-dceextUpgrade glibc-dceext-64bitUpgrade glibc-htmlUpgrade glibc-devel-debuginfoUpgrade glibc-infoUpgrade glibc-locale-32bitUpgrade glibc-obsoleteUpgrade glibc-utils-debuginfoUpgrade nscd-debuginfoUpgrade glibc-profile-x86Upgrade glibc-utils-debuginfo-32bitUpgrade nscdUpgrade glibc-devel-32bitUpgrade glibcUpgrade glibc-profile-32bitUpgrade glibc-debuginfo-32bitUpgrade glibc-locale-64bitUpgrade glibc-obsolete-debuginfoUpgrade glibc-dceext-x86Upgrade glibc-32bitUpgrade glibc-profileUpgrade glibc-dceext-32bitUpgrade glibc-devel-staticUpgrade glibc-utils-32bitUpgrade glibc-debugsourceUpgrade glibc-develUpgrade glibc-debuginfoUpgrade glibc-i18ndataUpgrade glibc-devel-64bitUpgrade glibc-64bitUpgrade glibc-devel-debuginfo-32bitUpgrade glibc-locale-debuginfo-32bitUpgrade glibc-locale-x86Upgrade glibc-x86Upgrade glibc-profile-64bitUpgrade glibc-locale | Feb 17, 2015 | May 2, 2013 |
| Ubuntu | — | Upgrade libc-binUpgrade libc6 | Nov 8, 2024 | May 2, 2013 |
| Vmsa 2012 0013 | — | Upgrade VMware ESX 4.1 to build number 800380 | Sep 17, 2012 | Sep 17, 2012 |
| Vmsa 2012 0018 | — | Upgrade VMware ESXi 5.0 to build number 912577Upgrade VMware ESXi 5.1 to build number 911593 | Jan 4, 2013 | Jan 4, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub