7.4High

CVE-2024-33602nscd: netgroup cache assumes NSS callback uses in-buffer strings

The GNU C Library glibc; gnu glibc; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Published: 2024-05-06 22:22 (2 years ago)

Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

Weakness (CWE): CWE-466

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
gnu	glibc	2.15 – < 2.40
The GNU C Library	glibc	2.15 – < 2.40
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5

References and patches

CVSS score

7.4High

Source: CISA-ADP · CVSS 3.1

Attack vector: Local
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (chance of exploitation in 30 days)

0.40%

higher than 35% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2024-04-24
Published2024-05-06 22:22
Reached IP-DB2026-10-24 23:54
Last updated2026-10-15 03:40

Assigned by (CNA): glibc

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — GNU C Library (glibc)

3.7Low

CVE-2026-100290 yesterday

Double free after allocation failure in regcomp and regexec

The GNU C Library glibc

The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node ta…

4.8Medium

CVE-2026-115819 yesterday

One-byte buffer overflow in wide scanf %s and %[ conversions

The GNU C Library glibc

Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the…

5.9Medium

CVE-2026-122054 8 days ago

BIG-HKSCS decoding hang on crafted input

The GNU C Library glibc

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

7.0High

CVE-2026-84243 13 days ago

gettext: Directory traversal via the LANGUAGE environment variable

The GNU C Library glibc

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the en…

3.7Low

CVE-2026-97399 1 month ago

One-byte overread in strncasecmp on Power8

The GNU C Library glibc

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to th…

3.6Low

CVE-2026-95818 1 month ago

AT_SECURE program buffer overflow via $ORIGIN processing

The GNU C Library glibc

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH beg…