8.1
CVE-2015-7547
- EPSS 93.42%
- Published 18.02.2016 21:59:00
- Last modified 12.04.2025 10:46:40
- Source secalert@redhat.com
- Teams watchlist Login
- Open Login
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
Data is provided by the National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version8.0
Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version15.10
Hp ≫ Helion Openstack Version1.1.1
Hp ≫ Helion Openstack Version2.0.0
Hp ≫ Helion Openstack Version2.1.0
Hp ≫ Server Migration Pack Version7.5
Sophos ≫ Unified Threat Management Software Version9.319
Sophos ≫ Unified Threat Management Software Version9.355
Suse ≫ Linux Enterprise Debuginfo Version11.0 Updatesp2
Suse ≫ Linux Enterprise Debuginfo Version11.0 Updatesp3
Suse ≫ Linux Enterprise Debuginfo Version11.0 Updatesp4
Suse ≫ Linux Enterprise Desktop Version11.0 Updatesp3
Suse ≫ Linux Enterprise Desktop Version11.0 Updatesp4
Suse ≫ Linux Enterprise Desktop Version12
Suse ≫ Linux Enterprise Desktop Version12 Updatesp1
Suse ≫ Linux Enterprise Server Version11.0 Updatesp2 SwEditionlts
Suse ≫ Linux Enterprise Server Version11.0 Updatesp3
Suse ≫ Linux Enterprise Server Version11.0 Updatesp3 SwPlatformvmware
Suse ≫ Linux Enterprise Server Version11.0 Updatesp4
Suse ≫ Linux Enterprise Server Version12 Updatesp1
Suse ≫ Linux Enterprise Software Development Kit Version11.0 Updatesp3
Suse ≫ Linux Enterprise Software Development Kit Version11.0 Updatesp4
Suse ≫ Linux Enterprise Software Development Kit Version12
Suse ≫ Linux Enterprise Software Development Kit Version12 Updatesp1
Suse ≫ Suse Linux Enterprise Server Version12
Oracle ≫ Exalogic Infrastructure Version1.0
Oracle ≫ Exalogic Infrastructure Version2.0
F5 ≫ Big-ip Access Policy Manager Version12.0.0
F5 ≫ Big-ip Advanced Firewall Manager Version12.0.0
F5 ≫ Big-ip Analytics Version12.0.0
F5 ≫ Big-ip Application Acceleration Manager Version12.0.0
F5 ≫ Big-ip Application Security Manager Version12.0.0
F5 ≫ Big-ip Domain Name System Version12.0.0
F5 ≫ Big-ip Link Controller Version12.0.0
F5 ≫ Big-ip Local Traffic Manager Version12.0.0
F5 ≫ Big-ip Policy Enforcement Manager Version12.0.0
Oracle ≫ Fujitsu M10 Firmware Version <= 2290
Redhat ≫ Enterprise Linux Desktop Version7.0
Redhat ≫ Enterprise Linux Hpc Node Version7.0
Redhat ≫ Enterprise Linux Hpc Node Eus Version7.2
Redhat ≫ Enterprise Linux Server Version7.0
Redhat ≫ Enterprise Linux Server Aus Version7.2
Redhat ≫ Enterprise Linux Server Eus Version7.2
Redhat ≫ Enterprise Linux Workstation Version7.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 93.42% | 0.998 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 8.1 | 2.2 | 5.9 |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.