NetSight
IP …
high8.1Public exploit code

CVE-2015-7547

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

Affected products

VendorProductAffected versions
DebianDebian Linux
Version 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.10
HpHelion Openstack
Versions 1.1.1, 2.0.0, 2.1.0
HpServer Migration Pack
Version 7.5
SophosUnified Threat Management Software
Versions 9.319, 9.355
SuseLinux Enterprise Debuginfo
Version 11.0
OpensuseOpensuse
Version 13.2
SuseLinux Enterprise Desktop
Versions 11.0, 12
SuseLinux Enterprise Server
Versions 11.0, 12
SuseLinux Enterprise Software Development Kit
Versions 11.0, 12
SuseSuse Linux Enterprise Server
Version 12
OracleExalogic Infrastructure
Versions 1.0, 2.0

Weakness classification

CWE-119

References