Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

glibc getaddrinfo can crash or be exploited

CVE-2013-7424 · published 11 years ago
Summary

The standard C library (glibc) versions earlier than 2.15 can mishandle special domain names when the AI_IDN option is used, causing the program to free memory incorrectly. This can make the affected application stop working or, in rare cases, allow an attacker to run their own code. Update glibc to version 2.15 or later, or avoid using the AI_IDN flag with libidn.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gnu glibc <= 2.14.1
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
Original advisory text
The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free) and possibly exe...
The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free) and possibly execute arbitrary code via unspecified vectors, as demonstrated by an internationalized domain name to ping6.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.1 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-17DEPRECATED: Code
Timeline
Published26 Aug 2015
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2013-7424 · NVD
Track software like this
Free during beta