rpm package
almalinux/glibc-benchtests
pkg:rpm/almalinux/glibc-benchtests
Vulnerabilities (34)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-4806 | Med | 5.9 | < 2.34-60.el9_2.7 | 2.34-60.el9_2.7 | Sep 18, 2023 | A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanon | |
| CVE-2023-4527 | Med | 6.5 | < 2.34-60.el9_2.7 | 2.34-60.el9_2.7 | Sep 18, 2023 | A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function ret | |
| CVE-2023-4813 | Med | 5.9 | < 2.34-60.el9_2.7 | 2.34-60.el9_2.7 | Sep 12, 2023 | A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is conf | |
| CVE-2021-3999 | Hig | 7.8 | < 2.28-164.el8_5.3 | 2.28-164.el8_5.3 | Aug 24, 2022 | A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to pote | |
| CVE-2022-23219 | Cri | 9.8 | < 2.28-164.el8_5.3 | 2.28-164.el8_5.3 | Jan 14, 2022 | The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if | |
| CVE-2022-23218 | Cri | 9.8 | < 2.28-164.el8_5.3 | 2.28-164.el8_5.3 | Jan 14, 2022 | The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if | |
| CVE-2021-35942 | Cri | 9.1 | < 2.28-164.el8 | 2.28-164.el8 | Jul 22, 2021 | The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because | |
| CVE-2021-33574 | Cri | 9.8 | < 2.28-164.el8 | 2.28-164.el8 | May 25, 2021 | The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (applicat | |
| CVE-2020-27618 | Med | 5.5 | < 2.28-151.el8 | 2.28-151.el8 | Feb 26, 2021 | The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, | |
| CVE-2021-27645 | Low | 2.5 | < 2.28-164.el8 | 2.28-164.el8 | Feb 24, 2021 | The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to | |
| CVE-2021-3326 | Hig | 7.5 | < 2.28-151.el8 | 2.28-151.el8 | Jan 27, 2021 | The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. | |
| CVE-2019-25013 | Med | 5.9 | < 2.28-151.el8 | 2.28-151.el8 | Jan 4, 2021 | The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. | |
| CVE-2019-9169 | Cri | 9.8 | < 2.28-151.el8 | 2.28-151.el8 | Feb 26, 2019 | In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. | |
| CVE-2016-10228 | Med | 5.9 | < 2.28-151.el8 | 2.28-151.el8 | Mar 2, 2017 | The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a d |
- affected < 2.34-60.el9_2.7fixed 2.34-60.el9_2.7
A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanon
- affected < 2.34-60.el9_2.7fixed 2.34-60.el9_2.7
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function ret
- affected < 2.34-60.el9_2.7fixed 2.34-60.el9_2.7
A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is conf
- affected < 2.28-164.el8_5.3fixed 2.28-164.el8_5.3
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to pote
- affected < 2.28-164.el8_5.3fixed 2.28-164.el8_5.3
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if
- affected < 2.28-164.el8_5.3fixed 2.28-164.el8_5.3
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if
- affected < 2.28-164.el8fixed 2.28-164.el8
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because
- affected < 2.28-164.el8fixed 2.28-164.el8
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (applicat
- affected < 2.28-151.el8fixed 2.28-151.el8
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications,
- affected < 2.28-164.el8fixed 2.28-164.el8
The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to
- affected < 2.28-151.el8fixed 2.28-151.el8
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
- affected < 2.28-151.el8fixed 2.28-151.el8
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.
- affected < 2.28-151.el8fixed 2.28-151.el8
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
- affected < 2.28-151.el8fixed 2.28-151.el8
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a d
Page 2 of 2