CVE-2016-3706

In the GNU C Library (glibc) versions 2.19 through 2.26, there is a flaw in handling RPATH and RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE) programs. This allows local users to gain privileges via a Trojan horse library in the current working directory.

The xdr_bytes and xdr_string functions in the GNU C Library (glibc) version 2.25 mishandle buffer deserialization failures, allowing remote attackers to cause a denial of service via a crafted UDP packet to port 111.

Integer overflow in the _IO_wstr_overflow function in the GNU C Library (glibc) before version 2.22 can lead to application crashes or potentially allow arbitrary code execution. Attackers can exploit this vulnerability by manipulating size calculations in bytes, triggering a heap-based buffer overflow.

A memory leak in the __res_vinit function in the IPv6 name server management code in GNU C Library (glibc) before version 2.24 allows remote attackers to cause a denial of service by leveraging partial initialization of internal resolver data structures.

The makecontext function in the GNU C Library (glibc) before version 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms. This may allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.

A stack-based buffer overflow exists in the nss_dns implementation of the getnetbyname function in GNU C Library (glibc) before version 2.24. Attackers can exploit this vulnerability by providing a long name, leading to application crashes.

A stack-based buffer overflow in the glob implementation in GNU C Library (glibc) before version 2.24 can be exploited by context-dependent attackers. This allows them to cause a denial of service (crash) by providing a long name.

Multiple stack-based buffer overflows in the libresolv library in GNU C Library (glibc) before version 2.23 exist in the send_dg and send_vc functions. Remote attackers can cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response.

The get_contents function in the GNU C Library (glibc) before version 2.20 may allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.

The nss_dns implementation of getnetbyname in GNU C Library (glibc) before version 2.21 allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being processed.