CVE-2015-7547
HighSummary
Multiple stack-based buffer overflows in the libresolv library in GNU C Library (glibc) before version 2.23 exist in the send_dg and send_vc functions. Remote attackers can cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response.
Risk Assessment
This vulnerability can lead to system crashes or remote code execution, posing a serious security threat to the organization. Attackers may exploit this flaw to conduct denial of service attacks or remotely take control of the system.
Recommendation
It is recommended to update the GNU C Library to version 2.23 or later to mitigate this vulnerability. Additionally, monitoring and filtering DNS responses is advisable to minimize the risk of attacks exploiting this flaw.
Other vulnerabilities in GNU C Library (glibc)
See all- CVE-2017-16997High
In the GNU C Library (glibc) versions 2.19 through 2.26, there is a flaw in handling RPATH and RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE) programs. This allows local users to gain privileges via a Trojan horse library in the current working directory.
- CVE-2017-8804High
The xdr_bytes and xdr_string functions in the GNU C Library (glibc) version 2.25 mishandle buffer deserialization failures, allowing remote attackers to cause a denial of service via a crafted UDP packet to port 111.
- CVE-2015-8983High
Integer overflow in the _IO_wstr_overflow function in the GNU C Library (glibc) before version 2.22 can lead to application crashes or potentially allow arbitrary code execution. Attackers can exploit this vulnerability by manipulating size calculations in bytes, triggering a heap-based buffer overflow.
- CVE-2016-5417High
A memory leak in the __res_vinit function in the IPv6 name server management code in GNU C Library (glibc) before version 2.24 allows remote attackers to cause a denial of service by leveraging partial initialization of internal resolver data structures.
- CVE-2016-6323High
The makecontext function in the GNU C Library (glibc) before version 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms. This may allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.
- CVE-2016-3706High
A stack-based buffer overflow in the getaddrinfo function in the GNU C Library (glibc) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion.
- CVE-2016-3075High
A stack-based buffer overflow exists in the nss_dns implementation of the getnetbyname function in GNU C Library (glibc) before version 2.24. Attackers can exploit this vulnerability by providing a long name, leading to application crashes.
- CVE-2016-1234High
A stack-based buffer overflow in the glob implementation in GNU C Library (glibc) before version 2.24 can be exploited by context-dependent attackers. This allows them to cause a denial of service (crash) by providing a long name.
- CVE-2015-5277High
The get_contents function in the GNU C Library (glibc) before version 2.20 may allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.
- CVE-2014-9402High
The nss_dns implementation of getnetbyname in GNU C Library (glibc) before version 2.21 allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being processed.
Original NVD description (English source)
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.