IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.8Alta

CVE-2025-4802

The GNU C Library glibc Publicada: (hace 1 año)

Descripción

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

Debilidad (CWE): CWE-426

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
gnu glibc 2.27 – ≤ 2.38
The GNU C Library glibc 2.27 – < 2.39

Referencias y parches

Coincidencias CPE (NVD) (1)
  • cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* ≥ 2.27 ≤ 2.38

CVE recientes del mismo producto — GNU C Library (glibc)

5.9Media
CVE-2026-122054

BIG-HKSCS decoding hang on crafted input

The GNU C Library glibc

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

3.7Baja
CVE-2026-97399

One-byte overread in strncasecmp on Power8

The GNU C Library glibc

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to th…

3.6Baja
CVE-2026-95818

AT_SECURE program buffer overflow via $ORIGIN processing

The GNU C Library glibc

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH beg…