Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match. (CVE-2009-5155)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match. (CVE-2009-5155)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14923-1 advisory.

  - Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows     context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a     long string, which triggers a stack-based buffer overflow. (CVE-2015-8982)

  - Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or     libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or     possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-     based buffer overflow. (CVE-2015-8983)

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-3239-1 fixed vulnerabilities in the GNU C Library. Unfortunately, the fix for CVE-2016-3706 introduced a regression that in some circumstances prevented IPv6 addresses from resolving. This update reverts the change in Ubuntu 12.04 LTS. We apologize for the error.

It was discovered that the GNU C Library incorrectly handled the strxfrm() function. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8982)

It was discovered that an integer overflow existed in the
_IO_wstr_overflow() function of the GNU C Library. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8983)

It was discovered that the fnmatch() function in the GNU C Library did not properly handle certain malformed patterns.
An attacker could use this to cause a denial of service.
This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8984)

Alexander Cherepanov discovered a stack-based buffer overflow in the glob implementation of the GNU C Library. An attacker could use this to specially craft a directory layout and cause a denial of service. (CVE-2016-1234)

Michael Petlan discovered an unbounded stack allocation in the getaddrinfo() function of the GNU C Library. An attacker could use this to cause a denial of service. (CVE-2016-3706)

Aldy Hernandez discovered an unbounded stack allocation in the sunrpc implementation in the GNU C Library. An attacker could use this to cause a denial of service. (CVE-2016-4429)

Tim Ruehsen discovered that the getaddrinfo() implementation in the GNU C Library did not properly track memory allocations. An attacker could use this to cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-5417)

Andreas Schwab discovered that the GNU C Library on ARM 32-bit platforms did not properly set up execution contexts.
An attacker could use this to cause a denial of service.
(CVE-2016-6323).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3239-1 advisory.

    It was discovered that the GNU C Library incorrectly handled the strxfrm() function. An attacker could use     this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected     Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8982)

    It was discovered that an integer overflow existed in the _IO_wstr_overflow() function of the GNU C     Library. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This     issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8983)

    It was discovered that the fnmatch() function in the GNU C Library did not properly handle certain     malformed patterns. An attacker could use this to cause a denial of service. This issue only affected     Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8984)

    Alexander Cherepanov discovered a stack-based buffer overflow in the glob implementation of the GNU C     Library. An attacker could use this to specially craft a directory layout and cause a denial of service.
    (CVE-2016-1234)

    Florian Weimer discovered a NULL pointer dereference in the DNS resolver of the GNU C Library. An attacker     could use this to cause a denial of service. (CVE-2015-5180)

    Michael Petlan discovered an unbounded stack allocation in the getaddrinfo() function of the GNU C     Library. An attacker could use this to cause a denial of service. (CVE-2016-3706)

    Aldy Hernandez discovered an unbounded stack allocation in the sunrpc implementation in the GNU C Library.
    An attacker could use this to cause a denial of service. (CVE-2016-4429)

    Tim Ruehsen discovered that the getaddrinfo() implementation in the GNU C Library did not properly track     memory allocations. An attacker could use this to cause a denial of service. This issue only affected     Ubuntu 16.04 LTS. (CVE-2016-5417)

    Andreas Schwab discovered that the GNU C Library on ARM 32-bit platforms did not properly set up execution     contexts. An attacker could use this to cause a denial of service. (CVE-2016-6323)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199103	RHEL 6 : glibc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199014	RHEL 5 : glibc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
159134	SUSE SLES11 Security Update : glibc (SUSE-SU-2022:14923-1)	Nessus	SuSE Local Security Checks	critical
97936	Ubuntu 12.04 LTS : eglibc regression (USN-3239-3)	Nessus	Ubuntu Local Security Checks	high
97856	Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library vulnerabilities (USN-3239-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2015-8983

high

Tenable Plugins

critical

critical

critical

high

high