VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 28, 2015· Updated May 6, 2026

CVE-2015-1781

CVE-2015-1781

Description

Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Buffer overflow in glibc's gethostbyname_r and NSS functions before 2.22 allows arbitrary code execution via a crafted DNS response.

Vulnerability

A buffer overflow exists in the gethostbyname_r and other unspecified NSS (Name Service Switch) functions in the GNU C Library (glibc) prior to version 2.22 [2]. The flaw occurs when these functions compute the size of a buffer after being passed a misaligned buffer as input. A crafted DNS response can trigger this condition, leading to a buffer overflow [1][4]. The issue affects all applications that use these functions with a misaligned buffer, which can be induced by a malicious DNS server response.

Exploitation

An attacker must be able to cause an application to call any of the affected NSS functions with a misaligned buffer. This can be achieved by sending a specially crafted DNS response to a vulnerable application that performs hostname resolution. No authentication is required if the application is reachable over the network. The attacker does not need local access; the attack is context-dependent and can be triggered remotely via DNS queries [1].

Impact

Successful exploitation can result in a denial of service (application crash) or arbitrary code execution with the privileges of the user running the vulnerable application [1][4]. The impact is limited to the application's user context, but could lead to full system compromise if the application runs with elevated privileges.

Mitigation

The vulnerability is fixed in glibc version 2.22 [2]. Red Hat Enterprise Linux 6 users should apply the update provided in RHSA-2015-0863 [1]. Ubuntu users should apply the update from USN-2985-1 [4]. No workaround is available; updating to the fixed version is the only mitigation. The vulnerability is rated Moderate severity by Red Hat [1].

References
  1. https://rhn.redhat.com/errata/RHSA-2015-0863.html
  2. The GNU C Library version 2.22 is now available
  3. USN-2985-1: GNU C Library vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.