NetSight
IP …
medium6.5

CVE-2023-4527

A flaw was found in glibc.

Impact

A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

Affected products

VendorProductAffected versions
GnuGlibc
from 2.36 before 2.36.113
from 2.37 before 2.37.38
from 2.38 before 2.38.19
RedhatCodeready Linux Builder Eus
Version 9.2
RedhatCodeready Linux Builder Eus For Power Little Endian
Version 9.0_ppc64le
RedhatCodeready Linux Builder Eus For Power Little Endian Eus
Version 9.2_ppc64le
RedhatCodeready Linux Builder For Arm64
Version 9.0_aarch64
RedhatCodeready Linux Builder For Arm64 Eus
Version 9.2_aarch64
RedhatCodeready Linux Builder For Ibm Z Systems
Version 9.0_s390x
RedhatCodeready Linux Builder For Ibm Z Systems Eus
Version 9.2_s390x
RedhatEnterprise Linux
Versions 8.0, 9.0
RedhatEnterprise Linux Eus
Versions 8.8, 9.2
RedhatEnterprise Linux For Arm 64
Version 9.0_aarch64
RedhatEnterprise Linux For Arm 64 Eus
Version 9.2_aarch64

Weakness classification

CWE-121CWE-125

References