CVE-2017-1000366

A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This issue occurs when the syslog and vsyslog functions are called with a message larger than INT_MAX bytes, leading to an incorrect buffer size calculation and application crash.

The res_query function in libresolv in glibc before version 2.25 has a vulnerability that allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to process crashes.

The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.

In glibc versions before 2.19-18+deb8u4 on Debian jessie and before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS, 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS, 2.21-0ubuntu4.2 on Ubuntu 15.10, and 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10, there is a lack of namespace check associated with file-descriptor passing. This allows local users to capture keystrokes and spoof data, potentially gaining privileges.

CVE-2015-0235 involves a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc in versions 2.2 and other 2.x versions before 2.18. This allows attackers to execute arbitrary code via the gethostbyname or gethostbyname2 functions.

The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, allowing context-dependent attackers to trigger use-after-free vulnerabilities.

In glibc 2.15, a bug was introduced in the nscd daemon that causes a null pointer dereference when a not-found netgroup response is not added to the cache. This leads to a crash of nscd.

A flaw in glibc may cause the gaih_inet function to use freed memory in uncommon situations, leading to an application crash. This issue is only exploitable when getaddrinfo is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=.

The manual/search.texi documentation in the GNU C Library (glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root. This may allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.