Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2015-8778: glibc versions before 2.23 may crash or be exploited
CVE-2015-8778 · published 10 years ago
Summary
The standard Linux library called glibc (also known as libc6) in versions earlier than 2.23 has a mistake that can cause programs to stop working or, in rare cases, let an attacker run their own code. The problem is triggered by a special function that handles memory size calculations. Update the library to version 2.23 or later, or apply the vendor’s security patch, to eliminate the risk.
What to do
- Update debian glibc to version 2.21-8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | glibc |
< 2.21-8 Fix: upgrade to 2.21-8
|
| Debian:13 | debian | glibc |
< 2.21-8 Fix: upgrade to 2.21-8
|
| Debian:14 | debian | glibc |
< 2.21-8 Fix: upgrade to 2.21-8
|
| – | fedoraproject | fedora |
23 cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* |
| – | debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
12.04 14.04 15.10 cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* |
| – | gnu | glibc |
<= 2.22 cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* |
| – | suse | linux_enterprise_debuginfo |
11 cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2:*:*:*:*:*:* |
| – | opensuse | opensuse |
13.2 cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* |
| – | suse | linux_enterprise_desktop |
11 12 cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:* |
| – | suse | linux_enterprise_server |
11 12 cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:lts:*:*:* |
| – | suse | linux_enterprise_software_development_kit |
11 12 cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:* |
| – | suse | suse_linux_enterprise_server |
12 cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:* |
Original advisory text
Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the...
Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.
References
- http://www.debian.org/security/2016/dsa-3481
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html Third Party Advisory
- http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-G...
- http://rhn.redhat.com/errata/RHSA-2017-0680.html
- http://seclists.org/fulldisclosure/2019/Sep/7
- http://www.debian.org/security/2016/dsa-3480
- http://www.openwall.com/lists/oss-security/2016/01/19/11 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/01/20/1 Third Party Advisory
- http://www.securityfocus.com/bid/83275
- http://www.ubuntu.com/usn/USN-2985-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2985-2 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1916
- https://seclists.org/bugtraq/2019/Sep/7
- https://security.gentoo.org/glsa/201602-02 Third Party Advisory
- https://security.gentoo.org/glsa/201702-11
- https://sourceware.org/bugzilla/show_bug.cgi?id=18240 Issue Tracking
- https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2015-8778 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-119Buffer Overflow
Timeline
Published19 Apr 2016
Updated31 Oct 2026
First seen9 Sep 2026
Track software like this
Free during beta