GCVE - cpe:2.3:a:gnu:glibc:2.12:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gnu:glibc:2.12:*:*:*:*:*:*:*

part: a version: 2.12 update: *

Vendor	Gnu (`575dd98a-a14a-5d9e-a2eb-97d38d86fcb9`)
Product	Glibc (`b8610c0d-6ad8-566c-b276-03b23ae99324`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/glibc`	purl2cpe	2026-06-01 10:11:53.488928
`pkg:github/bminor/glibc`	purl2cpe	2026-06-01 10:11:53.488929
`pkg:github/lattera/glibc`	purl2cpe	2026-06-01 10:11:53.488931
`pkg:gnu/glibc`	purl2cpe	2026-06-01 10:11:53.488932
`pkg:rpm/fedora/glibc`	purl2cpe	2026-06-01 10:11:53.488933
`pkg:rpm/opensuse/glibc`	purl2cpe	2026-06-01 10:11:53.488935
`pkg:sourceware/glibc`	purl2cpe	2026-06-01 10:11:53.488936

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-7547`	vulnerable	2026-06-08 05:07:01.339878	Details available Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module. Published: 2016-02-18T21:00:00.000Z Updated: 2024-08-06T07:51:28.440Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1035020 http://marc.info/?l=bugtraq&m=146161017210491&w=2 http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html http://rhn.redhat.com/errata/RHSA-2016-0175.html https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05140858	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6040`	vulnerable	2026-06-08 05:05:56.130099	Details available GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8. Published: 2014-12-05T16:00:00.000Z Updated: 2024-08-06T12:03:02.407Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/69472 http://linux.oracle.com/errata/ELSA-2015-0016.html https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=41488498b6 https://security.gentoo.org/glsa/201602-02 http://www.mandriva.com/security/advisories?name=MDVSA-2014:175	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0475`	vulnerable	2026-06-08 05:05:13.067391	Details available Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable. Published: 2014-07-29T14:00:00.000Z Updated: 2024-08-06T09:20:17.952Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-2976 http://www.securityfocus.com/bid/68505 http://www.securitytracker.com/id/1030569 https://rhn.redhat.com/errata/RHSA-2014-1110.html http://www.openwall.com/lists/oss-security/2014/07/14/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3406`	vulnerable	2026-06-08 05:02:09.637206	Details available The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405. Published: 2014-02-10T17:00:00.000Z Updated: 2024-08-06T20:05:12.465Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2012-1200.html https://bugzilla.redhat.com/show_bug.cgi?id=826943 http://rhn.redhat.com/errata/RHSA-2012-1097.html https://security.gentoo.org/glsa/201503-04 http://rhn.redhat.com/errata/RHSA-2012-1098.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3404`	vulnerable	2026-06-08 05:02:09.630655	Details available The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers. Published: 2014-02-10T17:00:00.000Z Updated: 2024-08-06T20:05:12.567Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2012-1200.html https://sourceware.org/bugzilla/show_bug.cgi?id=12445 https://bugzilla.redhat.com/show_bug.cgi?id=833703 https://security.gentoo.org/glsa/201503-04 http://rhn.redhat.com/errata/RHSA-2012-1098.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2702`	vulnerable	2026-06-08 04:58:08.448279	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.