{"id":"CVE-2013-2207","aliases":["DEBIAN-CVE-2013-2207","EUVD-2013-2162","GHSA-g33j-hgrw-88mh","MGASA-2013-0340","SUSE-SU-2015:1424-1","SUSE-SU-2016:0470-1","UBUNTU-CVE-2013-2207","USN-2985-1","openSUSE-SU-2024:10154-1"],"status":"published","title":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions...","description":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.","severity":{"version":"2.0","score":2.6,"vector":"AV:L/AC:H/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00352,"percentile":0.29092,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-10-09T00:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"glibc","fixed_in":["2.21-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glibc","fixed_in":["2.21-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.21-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","fixed_in":["2.19-0ubuntu6.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-1"}]}]},{"source":"osv","ecosystem":"Mageia:2","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.1-11.2.mga2"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-7.2.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.87.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.45.66.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.8"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.8"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-2.3"}]}],"bundled":31}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"glibc"}],"references":[{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=15755","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://secunia.com/advisories/55113","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://sourceware.org/ml/libc-alpha/2013-08/msg00160.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2985-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=976408","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"https://security.gentoo.org/glsa/201503-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:283","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2985-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2207"},{"url":"https://github.com/advisories/GHSA-g33j-hgrw-88mh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2207","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0340.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=855385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=858238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=995839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1007545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=985625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1022280","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151424-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/830257","tags":["report"]},{"url":"https://bugzilla.suse.com/851280","tags":["report"]},{"url":"https://bugzilla.suse.com/918187","tags":["report"]},{"url":"https://bugzilla.suse.com/920338","tags":["report"]},{"url":"https://bugzilla.suse.com/927080","tags":["report"]},{"url":"https://bugzilla.suse.com/928723","tags":["report"]},{"url":"https://bugzilla.suse.com/932059","tags":["report"]},{"url":"https://bugzilla.suse.com/933770","tags":["report"]},{"url":"https://bugzilla.suse.com/933903","tags":["report"]},{"url":"https://bugzilla.suse.com/935286","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1781","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/847227","tags":["report"]},{"url":"https://bugzilla.suse.com/863499","tags":["report"]},{"url":"https://bugzilla.suse.com/892065","tags":["report"]},{"url":"https://bugzilla.suse.com/945779","tags":["report"]},{"url":"https://bugzilla.suse.com/950944","tags":["report"]},{"url":"https://bugzilla.suse.com/961721","tags":["report"]},{"url":"https://bugzilla.suse.com/962736","tags":["report"]},{"url":"https://bugzilla.suse.com/962737","tags":["report"]},{"url":"https://bugzilla.suse.com/962738","tags":["report"]},{"url":"https://bugzilla.suse.com/962739","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8779","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-2207","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2985-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3075","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5417","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2207","description":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.","status":"published","published":"2013-10-09T22:00:00Z","modified":"2024-08-06T15:27:41.09Z","updated_at":"2026-11-02T14:34:56.530545Z"}],"euvd":[{"id":"EUVD-2013-2162","description":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.","status":"published","published":"2013-10-09T22:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.164386Z"}],"ghsa":[{"id":"GHSA-g33j-hgrw-88mh","title":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions...","description":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.","status":"published","published":"2022-05-17T02:39:18Z","modified":"2023-01-27T05:05:36Z","updated_at":"2026-11-02T14:42:43.937226Z"}],"nvd":[{"id":"CVE-2013-2207","description":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.","status":"published","published":"2013-10-09T22:55:02.633Z","modified":"2026-06-16T23:52:56.777Z","cvss":[{"version":"2.0","score":2.6,"vector":"AV:L/AC:H/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:38.715467Z"}],"osv":[{"id":"CVE-2013-2207","description":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.","status":"published","published":"2013-10-09T22:55:02Z","modified":"2026-04-16T06:17:12.19596021Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2207","description":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.","status":"published","published":"2013-10-09T22:55:02.633Z","modified":"2026-09-01T20:03:15.635502747Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0340","title":"Updated glibc package fixes security vulnerabilities","description":"Updated glibc packages fixes the following security issues:\n\nInteger overflow in string/strcoll_l.c in the GNU C Library (aka glibc\nor libc6) 2.17 and earlier allows context-dependent attackers to cause\na denial of service (crash) or possibly execute arbitrary code via a\nlong string, which triggers a heap-based buffer overflow. (CVE-2012-4412)\n\nStack-based buffer overflow in string/strcoll_l.c in the GNU C Library\n(aka glibc or libc6) 2.17 and earlier allows context-dependent\nattackers to cause a denial of service (crash) or possibly execute\narbitrary code via a long string that triggers a malloc failure and\nuse of the alloca function. (CVE-2012-4424)\n\npt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not\nproperly check permissions for tty files, which allows local users to\nchange the permission on the files and obtain access to arbitrary\npseudo-terminals by leveraging a FUSE file system. (CVE-2013-2207)\nNOTE! This is fixed by removing pt_chown wich may break chroots\n      if their devpts was not mounted correctly. \n      (make sure to mount the devpts correctly with gid=5)\n\nsysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6)\n2.18 and earlier allows context-dependent attackers to cause a denial\nof service (out-of-bounds write and crash) or possibly execute\narbitrary code via a crafted (1) NTFS or (2) CIFS image. (CVE-2013-4237)\n\nMultiple integer overflows in malloc/malloc.c in the GNU C Library\n(aka glibc or libc6) 2.18 and earlier allow context-dependent\nattackers to cause a denial of service (heap corruption) via a large\nvalue to the (1) pvalloc, (2) valloc, (3) posix_memalign, (4)\nmemalign, or (5) aligned_alloc functions. (CVE-2013-4332)\n\nA stack (frame) overflow flaw, which led to a denial of service \n(application crash), was found in the way glibc's getaddrinfo() function\nprocessed certain requests when called with AF_INET6. A similar flaw to\nCVE-2013-1914, this affects AF_INET6 rather than AF_UNSPEC (CVE-2013-4458).\n\nThe PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6)\n2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize\nthe random value for the pointer guard, which makes it easier for context-\ndependent attackers to control execution flow by leveraging a buffer-\noverflow vulnerability in an application and using the known zero value\npointer guard to calculate a pointer address. (CVE-2013-4788)\n\nOther fixes in this update:\n- Correct the processing of '\\x80' characters in crypt_freesec.c\n- drop minimal required kernel to 2.6.32 so it works in chroots on top\n  of enterprise kernels and for OpenVZ users.\n- fix typo in nscd.service\n","status":"published","published":"2013-11-22T18:44:49Z","modified":"2026-04-16T06:26:21.514210956Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10154-1","title":"glibc-2.24-2.3 on GA media","description":"These are all security issues fixed in the glibc-2.24-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:26.960082Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:1424-1","title":"Security update for glibc","description":"This update for glibc provides fixes for security and non-security issues.\n\nThese security issues have been fixed:\n\n- CVE-2015-1781: Buffer length after padding in resolv/nss_dns/dns-host.c. (bsc#927080)\n- CVE-2013-2207: pt_chown did not properly check permissions for tty files, which allowed\n  local users to change the permission on the files and obtain access to arbitrary\n  pseudo-terminals by leveraging a FUSE file system. (bsc#830257)\n- CVE-2014-8121: DB_LOOKUP in the Name Service Switch (NSS) did not properly check if a\n  file is open, which allowed remote attackers to cause a denial of service (infinite loop)\n  by performing a look-up while the database is iterated over the database, which triggers\n  the file pointer to be reset. (bsc#918187)\n- Fix read past end of pattern in fnmatch. (bsc#920338)\n\nThese non-security issues have been fixed:\n\n- Fix locking in _IO_flush_all_lockp() to prevent deadlocks in applications. (bsc#851280)\n- Record TTL also for DNS PTR queries. (bsc#928723)\n- Fix invalid free in ld.so. (bsc#932059)\n- Make PowerPC64 default to non-executable stack. (bsc#933770)\n- Fix floating point exceptions in some circumstances with exp() and friends. (bsc#933903)\n- Fix bad TEXTREL in glibc.i686. (bsc#935286)\n  ","status":"published","published":"2015-07-31T18:02:04Z","modified":"2026-02-04T02:57:26.061002Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0470-1","title":"Security update for glibc","description":"\nThis update for glibc fixes the following issues:\n\n- CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721)\n- CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944)\n- CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736)\n- CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737)\n- CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738)\n- CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739)\n- CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal (bsc#830257)\n- CVE-2013-4458: Stack (frame) overflow in getaddrinfo() when called with AF_INET6 (bsc#847227)\n- CVE-2014-8121: denial of service issue in the NSS backends (bsc#918187)\n- bsc#920338: Read past end of pattern in fnmatch\n- CVE-2015-1781: buffer overflow in nss_dns (bsc#927080)\n\nThe following non-security bugs were fixed:\n\n- bnc#892065: SIGSEV tst-setlocale3 in glibc-2.11.3-17.68.1\n- bnc#863499: Memory leak in getaddrinfo when many RRs are returned \n- bsc#892065: Avoid unbound alloca in setenv\n- bsc#945779: Properly reread entry after failure in nss_files getent function\n","status":"published","published":"2016-02-16T15:37:56Z","modified":"2026-02-04T03:05:55.904983Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2013-2207","description":"pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.","status":"published","published":"2013-10-09T00:00:00Z","modified":"2026-04-22T09:22:37.96411Z","updated_at":"2026-11-02T15:54:07.421078Z"},{"id":"USN-2985-1","title":"eglibc, glibc vulnerabilities","description":"Martin Carpenter discovered that pt_chown in the GNU C Library did not\nproperly check permissions for tty files. A local attacker could use this\nto gain administrative privileges or expose sensitive information.\n(CVE-2013-2207, CVE-2016-2856)\n\nRobin Hack discovered that the Name Service Switch (NSS) implementation in\nthe GNU C Library did not properly manage its file descriptors. An attacker\ncould use this to cause a denial of service (infinite loop).\n(CVE-2014-8121)\n\nJoseph Myers discovered that the GNU C Library did not properly handle long\narguments to functions returning a representation of Not a Number (NaN). An\nattacker could use this to cause a denial of service (stack exhaustion\nleading to an application crash) or possibly execute arbitrary code.\n(CVE-2014-9761)\n\nArjun Shankar discovered that in certain situations the nss_dns code in the\nGNU C Library did not properly account buffer sizes when passed an\nunaligned buffer. An attacker could use this to cause a denial of service\nor possibly execute arbitrary code. (CVE-2015-1781)\n\nSumit Bose and Lukas Slebodnik discovered that the Name Service\nSwitch (NSS) implementation in the GNU C Library did not handle long\nlines in the files databases correctly. A local attacker could use\nthis to cause a denial of service (application crash) or possibly\nexecute arbitrary code. (CVE-2015-5277)\n\nAdam Nielsen discovered that the strftime function in the GNU C Library did\nnot properly handle out-of-range argument data. An attacker could use this\nto cause a denial of service (application crash) or possibly expose\nsensitive information. (CVE-2015-8776)\n\nHector Marco and Ismael Ripoll discovered that the GNU C Library allowed\nthe pointer-guarding protection mechanism to be disabled by honoring the\nLD_POINTER_GUARD environment variable across privilege boundaries. A local\nattacker could use this to exploit an existing vulnerability more easily.\n(CVE-2015-8777)\n\nSzabolcs Nagy discovered that the hcreate functions in the GNU C Library\ndid not properly check its size argument, leading to an integer overflow.\nAn attacker could use to cause a denial of service (application crash) or\npossibly execute arbitrary code. (CVE-2015-8778)\n\nMaksymilian Arciemowicz discovered a stack-based buffer overflow in the\ncatopen function in the GNU C Library when handling long catalog names. An\nattacker could use this to cause a denial of service (application crash) or\npossibly execute arbitrary code. (CVE-2015-8779)\n\nFlorian Weimer discovered that the getnetbyname implementation in the GNU C\nLibrary did not properly handle long names passed as arguments. An attacker\ncould use to cause a denial of service (stack exhaustion leading to an\napplication crash). (CVE-2016-3075)\n","status":"published","published":"2016-05-25T20:22:47Z","modified":"2026-04-27T15:17:30.767227083Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}