CVE-2015-8983
HighSummary
Integer overflow in the _IO_wstr_overflow function in the GNU C Library (glibc) before version 2.22 can lead to application crashes or potentially allow arbitrary code execution. Attackers can exploit this vulnerability by manipulating size calculations in bytes, triggering a heap-based buffer overflow.
Risk Assessment
This vulnerability poses a risk of application crashes and the potential execution of malicious code, which can lead to serious security implications for the system. Organizations should be aware of potential attacks that may exploit this flaw.
Recommendation
It is recommended to update the GNU C Library to version 2.22 or later to mitigate the risks associated with this vulnerability. Additionally, monitoring applications for unusual behavior may help detect attempts to exploit this flaw.
Other vulnerabilities in GNU C Library (glibc)
See all- CVE-2017-16997High
In the GNU C Library (glibc) versions 2.19 through 2.26, there is a flaw in handling RPATH and RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE) programs. This allows local users to gain privileges via a Trojan horse library in the current working directory.
- CVE-2017-8804High
The xdr_bytes and xdr_string functions in the GNU C Library (glibc) version 2.25 mishandle buffer deserialization failures, allowing remote attackers to cause a denial of service via a crafted UDP packet to port 111.
- CVE-2016-5417High
A memory leak in the __res_vinit function in the IPv6 name server management code in GNU C Library (glibc) before version 2.24 allows remote attackers to cause a denial of service by leveraging partial initialization of internal resolver data structures.
- CVE-2016-6323High
The makecontext function in the GNU C Library (glibc) before version 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms. This may allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.
- CVE-2016-3706High
A stack-based buffer overflow in the getaddrinfo function in the GNU C Library (glibc) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion.
- CVE-2016-3075High
A stack-based buffer overflow exists in the nss_dns implementation of the getnetbyname function in GNU C Library (glibc) before version 2.24. Attackers can exploit this vulnerability by providing a long name, leading to application crashes.
- CVE-2016-1234High
A stack-based buffer overflow in the glob implementation in GNU C Library (glibc) before version 2.24 can be exploited by context-dependent attackers. This allows them to cause a denial of service (crash) by providing a long name.
- CVE-2015-7547High
Multiple stack-based buffer overflows in the libresolv library in GNU C Library (glibc) before version 2.23 exist in the send_dg and send_vc functions. Remote attackers can cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response.
- CVE-2015-5277High
The get_contents function in the GNU C Library (glibc) before version 2.20 may allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.
- CVE-2014-9402High
The nss_dns implementation of getnetbyname in GNU C Library (glibc) before version 2.21 allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being processed.
Original NVD description (English source)
Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.