GNU C Library (glibc) vulnerabilities

In the GNU C Library (glibc) versions 2.0 to 2.42, calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND may cause the interface to return uninitialized memory in the we_wordv member. Subsequent calls to wordfree may then abort the process.

In the GNU C Library (glibc) versions 2.0 to 2.42, calling getnetbyaddr or getnetbyaddr_r with an nsswitch.conf configured to use the library's DNS backend for networks and querying for a zero-valued network can leak stack contents to the configured DNS resolver.

In the GNU C Library (glibc) versions 2.19 through 2.26, there is a flaw in handling RPATH and RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE) programs. This allows local users to gain privileges via a Trojan horse library in the current working directory.

The xdr_bytes and xdr_string functions in the GNU C Library (glibc) version 2.25 mishandle buffer deserialization failures, allowing remote attackers to cause a denial of service via a crafted UDP packet to port 111.

Integer overflow in the _IO_wstr_overflow function in the GNU C Library (glibc) before version 2.22 can lead to application crashes or potentially allow arbitrary code execution. Attackers can exploit this vulnerability by manipulating size calculations in bytes, triggering a heap-based buffer overflow.

A memory leak in the __res_vinit function in the IPv6 name server management code in GNU C Library (glibc) before version 2.24 allows remote attackers to cause a denial of service by leveraging partial initialization of internal resolver data structures.

The makecontext function in the GNU C Library (glibc) before version 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms. This may allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.

A stack-based buffer overflow in the getaddrinfo function in the GNU C Library (glibc) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion.

A stack-based buffer overflow exists in the nss_dns implementation of the getnetbyname function in GNU C Library (glibc) before version 2.24. Attackers can exploit this vulnerability by providing a long name, leading to application crashes.

A stack-based buffer overflow in the glob implementation in GNU C Library (glibc) before version 2.24 can be exploited by context-dependent attackers. This allows them to cause a denial of service (crash) by providing a long name.

Multiple stack-based buffer overflows in the libresolv library in GNU C Library (glibc) before version 2.23 exist in the send_dg and send_vc functions. Remote attackers can cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response.

The get_contents function in the GNU C Library (glibc) before version 2.20 may allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.

The nss_dns implementation of getnetbyname in GNU C Library (glibc) before version 2.21 allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being processed.

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.

In the GNU C Library (glibc) through version 2.29, there is uncontrolled recursion in the check_dst_limits_calc_pos_1 function in posix/regexec.c, which may lead to performance issues or application crashes.

The glob function in the GNU C Library (glibc) before version 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.

The GNU C Library (glibc) before version 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function. This issue is related to the processing of home directories using the ~ operator followed by a long string.

A stack-based buffer overflow in the catopen function in the GNU C Library (glibc) before version 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.

The strftime function in the GNU C Library (glibc) before version 2.23 allows context-dependent attackers to cause application crashes or possibly obtain sensitive information via an out-of-range time value.

Multiple stack-based buffer overflows in the GNU C Library (glibc) before version 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the nan, nanf, or nanl function.