GCVE - cpe:2.3:a:gnu:glibc:2.17:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gnu:glibc:2.17:*:*:*:*:*:*:*

part: a version: 2.17 update: *

Vendor	Gnu (`575dd98a-a14a-5d9e-a2eb-97d38d86fcb9`)
Product	Glibc (`b8610c0d-6ad8-566c-b276-03b23ae99324`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/glibc`	purl2cpe	2026-06-01 10:11:53.553686
`pkg:github/bminor/glibc`	purl2cpe	2026-06-01 10:11:53.553688
`pkg:github/lattera/glibc`	purl2cpe	2026-06-01 10:11:53.553689
`pkg:gnu/glibc`	purl2cpe	2026-06-01 10:11:53.553690
`pkg:rpm/fedora/glibc`	purl2cpe	2026-06-01 10:11:53.553691
`pkg:rpm/opensuse/glibc`	purl2cpe	2026-06-01 10:11:53.553693
`pkg:sourceware/glibc`	purl2cpe	2026-06-01 10:11:53.553694

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-7547`	vulnerable	2026-06-08 05:07:01.345672	Details available Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module. Published: 2016-02-18T21:00:00.000Z Updated: 2024-08-06T07:51:28.440Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1035020 http://marc.info/?l=bugtraq&m=146161017210491&w=2 http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html http://rhn.redhat.com/errata/RHSA-2016-0175.html https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05140858	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6040`	vulnerable	2026-06-08 05:05:56.134484	Details available GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8. Published: 2014-12-05T16:00:00.000Z Updated: 2024-08-06T12:03:02.407Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/69472 http://linux.oracle.com/errata/ELSA-2015-0016.html https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=41488498b6 https://security.gentoo.org/glsa/201602-02 http://www.mandriva.com/security/advisories?name=MDVSA-2014:175	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0475`	vulnerable	2026-06-08 05:05:13.071639	Details available Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable. Published: 2014-07-29T14:00:00.000Z Updated: 2024-08-06T09:20:17.952Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-2976 http://www.securityfocus.com/bid/68505 http://www.securitytracker.com/id/1030569 https://rhn.redhat.com/errata/RHSA-2014-1110.html http://www.openwall.com/lists/oss-security/2014/07/14/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4458`	vulnerable	2026-06-08 05:04:46.898496	Details available Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914. Published: 2013-12-12T18:00:00.000Z Updated: 2024-08-06T16:45:14.820Z Open on db.gcve.eu Reference links https://sourceware.org/ml/libc-alpha/2013-10/msg00733.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html http://www.mandriva.com/security/advisories?name=MDVSA-2013:284 https://security.gentoo.org/glsa/201503-04 http://www.mandriva.com/security/advisories?name=MDVSA-2013:283	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4332`	vulnerable	2026-06-08 05:04:35.607629	Details available Multiple integer overflows in malloc/malloc.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allow context-dependent attackers to cause a denial of service (heap corruption) via a large value to the (1) pvalloc, (2) valloc, (3) posix_memalign, (4) memalign, or (5) aligned_alloc functions. Published: 2013-10-09T22:00:00.000Z Updated: 2024-08-06T16:38:01.986Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2013-1605.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4332 http://secunia.com/advisories/55113 http://www.ubuntu.com/usn/USN-1991-1 http://www.openwall.com/lists/oss-security/2013/09/12/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4237`	vulnerable	2026-06-08 05:04:34.759086	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4122`	not_vulnerable	2026-06-08 05:04:33.877058	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0242`	vulnerable	2026-06-08 05:03:46.394171	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.