Every CVE Search/ Get API key

CVE-2015-8985

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent...

5.9 MediumFix available

CVE-2015-8985 is a medium vulnerability (CVSS 5.9) in Gnu Glibc, published March 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.89%, the 86th percentile. Fixed in glibc 2.28-1.

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.89%Up 1.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.9

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Record
CVE-2015-8985
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-19
Updated
2026-11-02
CVE List No score

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Record
CVE-2015-8985
Updated
2026-11-02
EUVDEUVD-2015-8839 No score

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Record
EUVD-2015-8839
Updated
2026-11-03
GitHub AdvisoriesGHSA-chf9-h36m-6388 5.9

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent...

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Record
GHSA-chf9-h36m-6388
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-44559 5.9

CVE-2015-8985 affecting package metis 5.1.0.3-7

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Record
AZL-44559
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-45306 5.9

CVE-2015-8985 affecting package suitesparse 7.11.0-1

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Record
AZL-45306
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSV 5.9

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Record
CVE-2015-8985
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2015-8985 5.9

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Record
DEBIAN-CVE-2015-8985
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2015-8985 5.9

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Record
UBUNTU-CVE-2015-8985
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2022:0832-1 No score

Security update for glibc

glibc was updated to fix the following issues:

Security issues fixed:

  • CVE-2022-23219: Fixed Buffer overflow in sunrpc clnt_create for 'unix' (bsc#1194768)
  • CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bsc#1194770)
  • CVE-2021-3999: Fixed getcwd to set errno to ERANGE for size == 1 (bsc#1194640)
  • CVE-2015-8985: Fixed Assertion failure in pop_fail_stack when executing a malformed regexp (bsc#1193625)

Also the following bug was fixed:

  • Fix pthread_rwlock_try*lock stalls (bsc#1195560)
Record
SUSE-SU-2022:0832-1
Updated
2026-11-02
OSVSUSE-SU-2022:3942-1 No score

Security update for glibc

This update for glibc fixes the following issues:

  • CVE-2015-8985: Fixed assertion failure in pop_fail_stack when executing a malformed regexp (bsc#1193625)

  • x86: fix stack alignment in pthread_cond_[timed]wait (bsc#1196852)

  • Recognize ppc64p7 arch to build for power7

Record
SUSE-SU-2022:3942-1
Updated
2026-11-02
OSVSUSE-SU-2022:3942-2 No score

Security update for glibc

This update for glibc fixes the following issues:

  • CVE-2015-8985: Fixed assertion failure in pop_fail_stack when executing a malformed regexp (bsc#1193625)

  • x86: fix stack alignment in pthread_cond_[timed]wait (bsc#1196852)

  • Recognize ppc64p7 arch to build for power7

Record
SUSE-SU-2022:3942-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
metis
Azure Linux:3
 through 5.1.0.3-7 None known
suitesparse
Azure Linux:3
 through 7.11.0-1 None known
glibc
Debian:12
 before 2.28-1
2.28-1
glibc
Debian:13
 before 2.28-1
2.28-1
glibc
Debian:14
 before 2.28-1
2.28-1
glibc
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
 before 2.26-13.65.1
2.26-13.65.1
Show 26 moreShow less
Affected packages
PackageAffectedFixed
glibc
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Real Time 15 SP2
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Server 15-LTSS
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Server 15 SP2-BCL
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Server for SAP Applications 15
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Manager Proxy 4.1
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Manager Retail Branch Server 4.1
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Manager Server 4.1
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Micro 5.0
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Enterprise Storage 6
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Enterprise Storage 7
 before 2.26-13.65.1
2.26-13.65.1
glibc
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 2.22-114.22.1
2.22-114.22.1
glibc
SUSE:Linux Enterprise Server 12 SP5
 before 2.22-114.22.1
2.22-114.22.1
glibc
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 2.22-114.22.1
2.22-114.22.1
glibc
SUSE:OpenStack Cloud 9
 before 2.22-114.22.1
2.22-114.22.1
glibc
SUSE:OpenStack Cloud Crowbar 9
 before 2.22-114.22.1
2.22-114.22.1
glibc
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 2.22-114.22.1
2.22-114.22.1
glibc
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 2.22-114.22.1
2.22-114.22.1
eglibc
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.17-93ubuntu42.18-0ubuntu12.18-0ubuntu22.18-0ubuntu42.18-0ubuntu5
Show 24 moreShow less
2.18-0ubuntu62.18-0ubuntu72.19-0ubuntu22.19-0ubuntu32.19-0ubuntu42.19-0ubuntu52.19-0ubuntu62.19-0ubuntu6.12.19-0ubuntu6.32.19-0ubuntu6.42.19-0ubuntu6.52.19-0ubuntu6.62.19-0ubuntu6.72.19-0ubuntu6.82.19-0ubuntu6.92.19-0ubuntu6.102.19-0ubuntu6.112.19-0ubuntu6.132.19-0ubuntu6.142.19-0ubuntu6.152.19-0ubuntu6.15+esm12.19-0ubuntu6.15+esm22.19-0ubuntu6.15+esm32.19-0ubuntu6.15+esm4
 None known
glibc
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.21-0ubuntu42.21-0ubuntu52.21-0ubuntu62.23-0ubuntu12.23-0ubuntu2
Show 18 moreShow less
2.23-0ubuntu32.23-0ubuntu42.23-0ubuntu52.23-0ubuntu62.23-0ubuntu72.23-0ubuntu92.23-0ubuntu102.23-0ubuntu112.23-0ubuntu11.22.23-0ubuntu11.32.23-0ubuntu11.3+esm12.23-0ubuntu11.3+esm22.23-0ubuntu11.3+esm32.23-0ubuntu11.3+esm52.23-0ubuntu11.3+esm62.23-0ubuntu11.3+esm72.23-0ubuntu11.3+esm82.23-0ubuntu11.3+esm9
 None known
glibc
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.26-0ubuntu22.26-0ubuntu2.12.27-0ubuntu22.27-0ubuntu32.27-3ubuntu1
Show 11 moreShow less
2.27-3ubuntu1.22.27-3ubuntu1.32.27-3ubuntu1.42.27-3ubuntu1.52.27-3ubuntu1.62.27-3ubuntu1.6+esm12.27-3ubuntu1.6+esm22.27-3ubuntu1.6+esm32.27-3ubuntu1.6+esm42.27-3ubuntu1.6+esm52.27-3ubuntu1.6+esm6
 None known

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open