Vulnerability CVE-2016-3706: Information
Description
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.
Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| glibc | sisyphus | 2.23-alt1 | 2.38.0.76.e9f05fa1c6-alt1 | ALT-PU-2016-1135-1 | 158600 | Fixed |
| glibc | p10 | 2.23-alt1 | 2.32-alt5.p10.2 | ALT-PU-2016-1135-1 | 158600 | Fixed |
| glibc | p9 | 2.23-alt1 | 2.27-alt14 | ALT-PU-2016-1135-1 | 158600 | Fixed |
| glibc | p8 | 2.23-alt2 | 2.23-alt3.M80P.2 | ALT-PU-2016-1514-1 | 164761 | Fixed |
| glibc | c10f1 | 2.23-alt1 | 2.32-alt5.p10.2 | ALT-PU-2016-1135-1 | 158600 | Fixed |
| glibc | c9f2 | 2.23-alt1 | 2.27-alt14 | ALT-PU-2016-1135-1 | 158600 | Fixed |
| glibc | c7 | 2.17-alt5.M70C.12 | 2.17-alt5.M70C.14 | ALT-PU-2016-2029-1 | 169527 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://sourceware.org/bugzilla/show_bug.cgi?id=20010 |
|
| openSUSE-SU-2016:1527 |
|
| openSUSE-SU-2016:1779 |
|
| 88440 |
|
| http://www-01.ibm.com/support/docview.wss?uid=swg21995039 |
|
| https://source.android.com/security/bulletin/2017-12-01 |
|
| 102073 |
|
| https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9 |