SB2019061314 - Multiple vulnerabilities in GNU Glibc

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019061314

SB2019061314 - Multiple vulnerabilities in GNU Glibc

Published: June 13, 2019 Updated: June 28, 2025

Security Bulletin ID SB2019061314
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2013-7423)

The vulnerability allows a remote non-authenticated attacker to corrupt data.

The send_dg function in resolv/res_send.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function.


2) Buffer overflow (CVE-ID: CVE-2015-5277)

The vulnerability allows a local user to execute arbitrary code.

The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.


3) Buffer overflow (CVE-ID: CVE-2014-9984)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.


Remediation

Install update from vendor's website.

References