{"id":"CVE-2013-4458","aliases":["BELL-CVE-2013-4458","DEBIAN-CVE-2013-4458","DLA-165-1","EUVD-2013-4328","GHSA-jcwq-q9mq-r3fv","MGASA-2013-0340","RHSA-2014:1391","SUSE-RU-2015:0794-1","SUSE-SU-2015:0253-1","SUSE-SU-2015:0439-1","SUSE-SU-2016:0470-1","UBUNTU-CVE-2013-4458","USN-2306-1","openSUSE-SU-2024:10154-1"],"status":"published","title":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C...","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04154,"percentile":0.90927,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2013-11-22T18:44:49Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"glibc","fixed_in":["2.18-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glibc","fixed_in":["2.18-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.18-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-4+deb6u5"}]}],"versions":["2.11.2-10","2.11.2-10+m68k.1","2.11.2-11","2.11.2-11+m68k.1","2.11.2-12","2.11.2-13","2.11.3-1","2.11.3-2","2.11.3-3","2.11.3-4"],"bundled":18},{"source":"osv","ecosystem":"Mageia:2","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.1-11.2.mga2"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-7.2.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-17.45.66.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.1"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-2.3"}]}],"bundled":31}],"products":[{"vendor":"gnu","product":"glibc"},{"vendor":"suse","product":"linux_enterprise_debuginfo"},{"vendor":"suse","product":"linux_enterprise_server"}],"references":[{"url":"https://sourceware.org/ml/libc-alpha/2013-10/msg00733.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:284","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201503-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:283","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=16072","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4458","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1391","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4458","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1022280","tags":["report"]},{"url":"https://github.com/advisories/GHSA-jcwq-q9mq-r3fv"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2013-4458","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4458","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0340.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=855385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=858238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=976408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=995839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1007545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=985625","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.6_Technical_Notes/glibc.html#RHSA-2014-1391","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=905941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=981942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1027101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1032628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1043557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1044628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1087833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1099025","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1391.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4237","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4237","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4458","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-7424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1186614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7424","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7424","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150794-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/691365","tags":["report"]},{"url":"https://bugzilla.suse.com/779320","tags":["report"]},{"url":"https://bugzilla.suse.com/791928","tags":["report"]},{"url":"https://bugzilla.suse.com/801246","tags":["report"]},{"url":"https://bugzilla.suse.com/811979","tags":["report"]},{"url":"https://bugzilla.suse.com/813121","tags":["report"]},{"url":"https://bugzilla.suse.com/819347","tags":["report"]},{"url":"https://bugzilla.suse.com/822210","tags":["report"]},{"url":"https://bugzilla.suse.com/827811","tags":["report"]},{"url":"https://bugzilla.suse.com/828235","tags":["report"]},{"url":"https://bugzilla.suse.com/828637","tags":["report"]},{"url":"https://bugzilla.suse.com/830268","tags":["report"]},{"url":"https://bugzilla.suse.com/834594","tags":["report"]},{"url":"https://bugzilla.suse.com/836746","tags":["report"]},{"url":"https://bugzilla.suse.com/839870","tags":["report"]},{"url":"https://bugzilla.suse.com/844309","tags":["report"]},{"url":"https://bugzilla.suse.com/847227","tags":["report"]},{"url":"https://bugzilla.suse.com/854445","tags":["report"]},{"url":"https://bugzilla.suse.com/863499","tags":["report"]},{"url":"https://bugzilla.suse.com/864081","tags":["report"]},{"url":"https://bugzilla.suse.com/872832","tags":["report"]},{"url":"https://bugzilla.suse.com/882028","tags":["report"]},{"url":"https://bugzilla.suse.com/882600","tags":["report"]},{"url":"https://bugzilla.suse.com/883217","tags":["report"]},{"url":"https://bugzilla.suse.com/886416","tags":["report"]},{"url":"https://bugzilla.suse.com/887022","tags":["report"]},{"url":"https://bugzilla.suse.com/888347","tags":["report"]},{"url":"https://bugzilla.suse.com/891843","tags":["report"]},{"url":"https://bugzilla.suse.com/892065","tags":["report"]},{"url":"https://bugzilla.suse.com/892073","tags":["report"]},{"url":"https://bugzilla.suse.com/894553","tags":["report"]},{"url":"https://bugzilla.suse.com/894556","tags":["report"]},{"url":"https://bugzilla.suse.com/903288","tags":["report"]},{"url":"https://bugzilla.suse.com/904461","tags":["report"]},{"url":"https://bugzilla.suse.com/906371","tags":["report"]},{"url":"https://bugzilla.suse.com/909053","tags":["report"]},{"url":"https://bugzilla.suse.com/913646","tags":["report"]},{"url":"https://bugzilla.suse.com/915526","tags":["report"]},{"url":"https://bugzilla.suse.com/916222","tags":["report"]},{"url":"https://bugzilla.suse.com/917072","tags":["report"]},{"url":"https://bugzilla.suse.com/919678","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1472","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150253-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150439-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160470-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/830257","tags":["report"]},{"url":"https://bugzilla.suse.com/918187","tags":["report"]},{"url":"https://bugzilla.suse.com/920338","tags":["report"]},{"url":"https://bugzilla.suse.com/927080","tags":["report"]},{"url":"https://bugzilla.suse.com/945779","tags":["report"]},{"url":"https://bugzilla.suse.com/950944","tags":["report"]},{"url":"https://bugzilla.suse.com/961721","tags":["report"]},{"url":"https://bugzilla.suse.com/962736","tags":["report"]},{"url":"https://bugzilla.suse.com/962737","tags":["report"]},{"url":"https://bugzilla.suse.com/962738","tags":["report"]},{"url":"https://bugzilla.suse.com/962739","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8779","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-4458","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2306-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-4357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4043","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5417","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4458","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.","status":"published","published":"2013-12-12T18:00:00Z","modified":"2024-08-06T16:45:14.82Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4328","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.","status":"published","published":"2013-12-12T18:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.667445Z"}],"ghsa":[{"id":"GHSA-jcwq-q9mq-r3fv","title":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C...","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.","status":"published","published":"2022-05-17T02:39:15Z","modified":"2023-02-10T05:06:23Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:54:01.789224Z"}],"nvd":[{"id":"CVE-2013-4458","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.","status":"published","published":"2013-12-12T18:55:10.883Z","modified":"2026-06-16T23:57:15.837Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:44.596064Z"}],"osv":[{"id":"BELL-CVE-2013-4458","title":"CVE-2013-4458 does not affect BellSoft software","status":"withdrawn","published":"2013-12-12T18:55:00Z","modified":"2026-01-28T07:19:27.782528Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2013-4458","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.","status":"published","published":"2013-12-12T18:55:10Z","modified":"2026-04-16T06:22:07.261231129Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4458","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.","status":"published","published":"2013-12-12T18:55:10.883Z","modified":"2026-09-01T20:03:18.202303766Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DLA-165-1","title":"eglibc - security update","status":"published","published":"2015-03-06T00:00:00Z","modified":"2026-03-09T01:18:41.690279Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2013-0340","title":"Updated glibc package fixes security vulnerabilities","description":"Updated glibc packages fixes the following security issues:\n\nInteger overflow in string/strcoll_l.c in the GNU C Library (aka glibc\nor libc6) 2.17 and earlier allows context-dependent attackers to cause\na denial of service (crash) or possibly execute arbitrary code via a\nlong string, which triggers a heap-based buffer overflow. (CVE-2012-4412)\n\nStack-based buffer overflow in string/strcoll_l.c in the GNU C Library\n(aka glibc or libc6) 2.17 and earlier allows context-dependent\nattackers to cause a denial of service (crash) or possibly execute\narbitrary code via a long string that triggers a malloc failure and\nuse of the alloca function. (CVE-2012-4424)\n\npt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not\nproperly check permissions for tty files, which allows local users to\nchange the permission on the files and obtain access to arbitrary\npseudo-terminals by leveraging a FUSE file system. (CVE-2013-2207)\nNOTE! This is fixed by removing pt_chown wich may break chroots\n      if their devpts was not mounted correctly. \n      (make sure to mount the devpts correctly with gid=5)\n\nsysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6)\n2.18 and earlier allows context-dependent attackers to cause a denial\nof service (out-of-bounds write and crash) or possibly execute\narbitrary code via a crafted (1) NTFS or (2) CIFS image. (CVE-2013-4237)\n\nMultiple integer overflows in malloc/malloc.c in the GNU C Library\n(aka glibc or libc6) 2.18 and earlier allow context-dependent\nattackers to cause a denial of service (heap corruption) via a large\nvalue to the (1) pvalloc, (2) valloc, (3) posix_memalign, (4)\nmemalign, or (5) aligned_alloc functions. (CVE-2013-4332)\n\nA stack (frame) overflow flaw, which led to a denial of service \n(application crash), was found in the way glibc's getaddrinfo() function\nprocessed certain requests when called with AF_INET6. A similar flaw to\nCVE-2013-1914, this affects AF_INET6 rather than AF_UNSPEC (CVE-2013-4458).\n\nThe PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6)\n2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize\nthe random value for the pointer guard, which makes it easier for context-\ndependent attackers to control execution flow by leveraging a buffer-\noverflow vulnerability in an application and using the known zero value\npointer guard to calculate a pointer address. (CVE-2013-4788)\n\nOther fixes in this update:\n- Correct the processing of '\\x80' characters in crypt_freesec.c\n- drop minimal required kernel to 2.6.32 so it works in chroots on top\n  of enterprise kernels and for OpenVZ users.\n- fix typo in nscd.service\n","status":"published","published":"2013-11-22T18:44:49Z","modified":"2026-04-16T06:26:21.514210956Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10154-1","title":"glibc-2.24-2.3 on GA media","description":"These are all security issues fixed in the glibc-2.24-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:26.960082Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:1391","title":"Red Hat Security Advisory: glibc security, bug fix, and enhancement update","status":"published","published":"2024-09-15T21:37:03Z","modified":"2026-06-28T10:11:39Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-RU-2015:0794-1","title":"Security update for glibc","description":"\nThis glibc update fixes a critical privilege escalation problem and two \nnon-security issues:\n\n    * bnc#892073: An off-by-one error leading to a heap-based buffer\n      overflow was found in __gconv_translit_find(). An exploit that\n      targets the problem is publicly available. (CVE-2014-5119)\n    * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.\n    * bnc#888347: printf-multibyte-format.patch: Don't parse %s format\n      argument as multi-byte string.\n\nSecurity Issues:\n\n    * CVE-2014-5119\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\u003e\n\n","status":"published","published":"2014-08-29T01:15:58Z","modified":"2026-02-04T04:36:32.287726Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0253-1","title":"Security update for glibc","description":"\nThis glibc update fixes a critical privilege escalation problem and two \nnon-security issues:\n\n    * bnc#892073: An off-by-one error leading to a heap-based buffer\n      overflow was found in __gconv_translit_find(). An exploit that\n      targets the problem is publicly available. (CVE-2014-5119)\n    * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.\n    * bnc#888347: printf-multibyte-format.patch: Don't parse %s format\n      argument as multi-byte string.\n\nSecurity Issues:\n\n    * CVE-2014-5119\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\u003e\n\n","status":"published","published":"2014-08-29T01:15:58Z","modified":"2026-02-04T02:39:46.246573Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0439-1","title":"Security update for glibc","description":"\nThis glibc update fixes a critical privilege escalation problem and two \nnon-security issues:\n\n    * bnc#892073: An off-by-one error leading to a heap-based buffer\n      overflow was found in __gconv_translit_find(). An exploit that\n      targets the problem is publicly available. (CVE-2014-5119)\n    * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.\n    * bnc#888347: printf-multibyte-format.patch: Don't parse %s format\n      argument as multi-byte string.\n\nSecurity Issues:\n\n    * CVE-2014-5119\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\u003e\n\n","status":"published","published":"2014-08-29T01:15:58Z","modified":"2026-02-04T03:13:26.319151Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2016:0470-1","title":"Security update for glibc","description":"\nThis update for glibc fixes the following issues:\n\n- CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721)\n- CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944)\n- CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736)\n- CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737)\n- CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738)\n- CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739)\n- CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal (bsc#830257)\n- CVE-2013-4458: Stack (frame) overflow in getaddrinfo() when called with AF_INET6 (bsc#847227)\n- CVE-2014-8121: denial of service issue in the NSS backends (bsc#918187)\n- bsc#920338: Read past end of pattern in fnmatch\n- CVE-2015-1781: buffer overflow in nss_dns (bsc#927080)\n\nThe following non-security bugs were fixed:\n\n- bnc#892065: SIGSEV tst-setlocale3 in glibc-2.11.3-17.68.1\n- bnc#863499: Memory leak in getaddrinfo when many RRs are returned \n- bsc#892065: Avoid unbound alloca in setenv\n- bsc#945779: Properly reread entry after failure in nss_files getent function\n","status":"published","published":"2016-02-16T15:37:56Z","modified":"2026-02-04T03:05:55.904983Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2013-4458","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914.","status":"withdrawn","published":"2013-12-12T00:00:00Z","modified":"2026-02-04T02:42:33.682486Z","updated_at":"2026-11-02T15:54:07.421078Z"},{"id":"USN-2306-1","title":"eglibc vulnerabilities","description":"Maksymilian Arciemowicz discovered that the GNU C Library incorrectly\nhandled the getaddrinfo() function. An attacker could use this issue to\ncause a denial of service. This issue only affected Ubuntu 10.04 LTS.\n(CVE-2013-4357)\n\nIt was discovered that the GNU C Library incorrectly handled the\ngetaddrinfo() function. An attacker could use this issue to cause a denial\nof service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS.\n(CVE-2013-4458)\n\nStephane Chazelas discovered that the GNU C Library incorrectly handled\nlocale environment variables. An attacker could use this issue to possibly\nbypass certain restrictions such as the ForceCommand restrictions in\nOpenSSH. (CVE-2014-0475)\n\nDavid Reid, Glyph Lefkowitz, and Alex Gaynor discovered that the GNU C\nLibrary incorrectly handled posix_spawn_file_actions_addopen() path\narguments. An attacker could use this issue to cause a denial of service.\n(CVE-2014-4043)\n","status":"published","published":"2014-08-04T15:37:16Z","modified":"2026-04-22T08:54:00.389695Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}