Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2015-20109: GNU C Library before 2.22 can crash applications
CVE-2015-20109 · published 3 years ago
Summary
The standard C library used by many Linux systems can be made to stop working if it receives a specially crafted pattern string. This can cause programs that rely on the library to crash, interrupting service. Upgrade the library to version 2.22 or later, or apply your operating system's latest security updates to resolve the issue.
What to do
- Update debian glibc to version 2.22-1.
- Update gnu glibc to version 2.22 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | glibc |
< 2.22-1 Fix: upgrade to 2.22-1
|
| Debian:13 | debian | glibc |
< 2.22-1 Fix: upgrade to 2.22-1
|
| Debian:14 | debian | glibc |
< 2.22-1 Fix: upgrade to 2.22-1
|
| – | gnu | glibc |
< 2.22 cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* |
Original advisory text
end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash), as demonst...
end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash), as demonstrated by use of the fnmatch library function with the **(!() pattern. NOTE: this is not the same as CVE-2015-8984; also, some Linux distributions have fixed CVE-2015-8984 but have not fixed this additional fnmatch issue.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-120Classic Buffer Overflow
Timeline
Published25 Jun 2023
Updated4 Nov 2026
First seen9 Sep 2026
Track software like this
Free during beta