Approved changes feed: RSS · Atom
cpe:2.3:a:uclibc-ng_project:uclibc-ng:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Uclibc Ng Project (78b8c5f0-93e4-5d98-a529-2211cb4e46cf) |
|---|---|
| Product | Uclibc Ng (9ff5160b-c4dc-5bca-b05b-084d14ca10c4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/brgl/uclibc-ng |
purl2cpe | 2026-06-01 10:18:19.015386 |
pkg:github/kraj/uclibc-ng |
purl2cpe | 2026-06-01 10:18:19.015388 |
pkg:github/wbx-github/uclibc-ng |
purl2cpe | 2026-06-01 10:18:19.015390 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-30295 |
vulnerable | 2026-06-08 05:43:37.847722 |
Details available
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.
Published: 2022-05-06T04:43:47.000Z
Updated: 2024-08-03T06:48:34.838Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43523 |
vulnerable | 2026-06-08 05:36:43.483623 |
Details available
In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, getaddrinfo, gethostbyaddr, and getnameinfo can lead to output of wrong hostnames (leading to domain hijacking) or injection into applications (leading to remote code execution, XSS, applications crashes, etc.). In other words, a validation step, which is expected in any stub resolver, does not occur.
Published: 2021-11-10T14:03:56.000Z
Updated: 2025-05-05T16:46:05.077Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27419 |
vulnerable | 2026-06-08 05:31:21.408265 |
uClibc-ng Integer Overflow or Wraparound
HIGH (7.3)
uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Published: 2022-05-03T20:20:49.000Z
Updated: 2025-04-16T16:25:17.246Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6264 |
vulnerable | 2026-06-08 05:07:59.311689 |
Details available
Integer signedness error in libc/string/arm/memset.S in uClibc and uClibc-ng before 1.0.16 allows context-dependent attackers to cause a denial of service (crash) via a negative length value to the memset function.
Published: 2017-01-27T22:01:00.000Z
Updated: 2024-08-06T01:22:20.895Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-2225 |
vulnerable | 2026-06-08 05:07:33.712033 |
Details available
The __read_etc_hosts_r function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a crafted packet.
Published: 2017-03-24T15:00:00.000Z
Updated: 2024-08-05T23:24:48.471Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-2224 |
vulnerable | 2026-06-08 05:07:33.711540 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.