IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
5.9Mittel

CVE-2023-4813Glibc: potential use-after-free in gaih_inet()

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Virtualiz… Veröffentlicht: (vor 3 Jahren)

Beschreibung

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Schwachstellentyp (CWE): CWE-416

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
enterprise linux 8 —
enterprise linux 9 —
fedoraproject fedora 38
gnu glibc < 2.36
netapp active iq unified manager —
netapp h300s firmware —
netapp h410c firmware —
netapp h410s firmware —
netapp h500s firmware —
netapp h700s firmware —
redhat enterprise linux 8.0
redhat enterprise linux eus 8.8
redhat enterprise linux for ibm z systems eus s390x 9.2
redhat enterprise linux for ibm z systems s390x 9.2
redhat enterprise linux for power little endian 9.2_ppc64le
redhat enterprise linux for power little endian eus 9.2_ppc64le
redhat enterprise linux server aus 9.2
redhat enterprise linux server tus 8.8
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 7 all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 all versions
rhel eus 8.6 —
rhev hypervisor 4.4 —
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.0 – < V3.1.5
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.0 – < V3.1.5
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.0 – < V3.1.5

Referenzen und Patches

CPE-Treffer (NVD) (18)
  • cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* < 2.36
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:9.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_s390x:9.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.2_ppc64le:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Neue CVEs im selben Produkt — GNU C Library (glibc)

5.9Mittel
CVE-2026-122054

BIG-HKSCS decoding hang on crafted input

The GNU C Library glibc

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

3.7Niedrig
CVE-2026-97399

One-byte overread in strncasecmp on Power8

The GNU C Library glibc

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to th…

3.6Niedrig
CVE-2026-95818

AT_SECURE program buffer overflow via $ORIGIN processing

The GNU C Library glibc

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH beg…

6.3Mittel
CVE-2026-86805

AT_SECURE programs may load attacker-controlled code via $ORIGIN

The GNU C Library glibc

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) progr…