rpm package
suse/glibc&distro=SUSE Linux Enterprise Server 11 SP4-LTSS
pkg:rpm/suse/glibc&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-3999 | — | < 2.11.3-17.110.40.1 | 2.11.3-17.110.40.1 | Aug 24, 2022 | A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to pote | ||
| CVE-2022-23219 | — | < 2.11.3-17.110.40.1 | 2.11.3-17.110.40.1 | Jan 14, 2022 | The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if | ||
| CVE-2022-23218 | — | < 2.11.3-17.110.40.1 | 2.11.3-17.110.40.1 | Jan 14, 2022 | The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if | ||
| CVE-2021-35942 | — | < 2.11.3-17.110.37.1 | 2.11.3-17.110.37.1 | Jul 22, 2021 | The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because | ||
| CVE-2021-33574 | — | < 2.11.3-17.110.37.1 | 2.11.3-17.110.37.1 | May 25, 2021 | The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (applicat | ||
| CVE-2019-9169 | — | < 2.11.3-17.110.33.1 | 2.11.3-17.110.33.1 | Feb 26, 2019 | In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. | ||
| CVE-2015-8983 | Hig | 8.1 | < 2.11.3-17.110.40.1 | 2.11.3-17.110.40.1 | Mar 20, 2017 | Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a si | |
| CVE-2015-8982 | Hig | 8.1 | < 2.11.3-17.110.40.1 | 2.11.3-17.110.40.1 | Mar 15, 2017 | Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow. |
- CVE-2021-3999Aug 24, 2022affected < 2.11.3-17.110.40.1fixed 2.11.3-17.110.40.1
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to pote
- CVE-2022-23219Jan 14, 2022affected < 2.11.3-17.110.40.1fixed 2.11.3-17.110.40.1
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if
- CVE-2022-23218Jan 14, 2022affected < 2.11.3-17.110.40.1fixed 2.11.3-17.110.40.1
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if
- CVE-2021-35942Jul 22, 2021affected < 2.11.3-17.110.37.1fixed 2.11.3-17.110.37.1
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because
- CVE-2021-33574May 25, 2021affected < 2.11.3-17.110.37.1fixed 2.11.3-17.110.37.1
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (applicat
- CVE-2019-9169Feb 26, 2019affected < 2.11.3-17.110.33.1fixed 2.11.3-17.110.33.1
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
- affected < 2.11.3-17.110.40.1fixed 2.11.3-17.110.40.1
Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a si
- affected < 2.11.3-17.110.40.1fixed 2.11.3-17.110.40.1
Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.