IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.8Yüksek

CVE-2025-4802

The GNU C Library glibc Yayım: (1 yıl önce)

Açıklama

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

Zayıflık türü (CWE): CWE-426

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
gnu glibc 2.27 – ≤ 2.38
The GNU C Library glibc 2.27 – < 2.39

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)
  • cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* ≥ 2.27 ≤ 2.38

Aynı üründe son açıklar — GNU C Library (glibc)

5.9Orta
CVE-2026-122054

BIG-HKSCS decoding hang on crafted input

The GNU C Library glibc

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

3.7Düşük
CVE-2026-97399

One-byte overread in strncasecmp on Power8

The GNU C Library glibc

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to th…

3.6Düşük
CVE-2026-95818

AT_SECURE program buffer overflow via $ORIGIN processing

The GNU C Library glibc

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH beg…