{"id":"CVE-2014-0475","aliases":["DEBIAN-CVE-2014-0475","DLA-43-1","DSA-2976-1","EUVD-2014-0510","GHSA-5rvh-fh5r-rhfv","MGASA-2014-0314","RHSA-2014:1110","SUSE-RU-2015:0794-1","SUSE-SU-2015:0253-1","SUSE-SU-2015:0439-1","UBUNTU-CVE-2014-0475","USN-2306-1","openSUSE-SU-2024:10154-1"],"status":"published","title":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20...","description":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02803,"percentile":0.86564,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2014-07-10T00:00:00Z","modified":"2026-10-23T15:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"glibc","fixed_in":["2.19-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glibc","fixed_in":["2.19-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.19-6"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"eglibc","fixed_in":["2.13-38+deb7u3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","fixed_in":["2.19-0ubuntu6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-6"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-4+deb6u1"}]}],"versions":["2.11.2-10","2.11.2-10+m68k.1","2.11.2-11","2.11.2-11+m68k.1","2.11.2-12","2.11.2-13","2.11.3-1","2.11.3-2","2.11.3-3","2.11.3-4"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-38+deb7u3"}]}],"versions":["2.13-38","2.13-38+deb7u1","2.13-38+deb7u2"]},{"source":"osv","ecosystem":"Mageia:3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-7.3.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-9.2.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5-118.el5_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.132.el6_5.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.1"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.1"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-2.3"}]}],"bundled":31}],"products":[{"vendor":"gnu","product":"glibc"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2976","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/68505","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1030569","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1110.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/07/14/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201602-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=17137","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/07/10/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:152","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://linux.oracle.com/errata/ELSA-2015-0092.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0475","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5rvh-fh5r-rhfv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0475","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0314.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13800","tags":["report"]},{"url":"https://www.sourceware.org/bugzilla/show_bug.cgi?id=17048","tags":["report"]},{"url":"https://www.sourceware.org/bugzilla/show_bug.cgi?id=16510","tags":["report"]},{"url":"https://www.sourceware.org/bugzilla/show_bug.cgi?id=15073","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1110","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/solutions/1176253","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1119128","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1110.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0475","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0475","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-5119","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5119","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150794-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/691365","tags":["report"]},{"url":"https://bugzilla.suse.com/779320","tags":["report"]},{"url":"https://bugzilla.suse.com/791928","tags":["report"]},{"url":"https://bugzilla.suse.com/801246","tags":["report"]},{"url":"https://bugzilla.suse.com/811979","tags":["report"]},{"url":"https://bugzilla.suse.com/813121","tags":["report"]},{"url":"https://bugzilla.suse.com/819347","tags":["report"]},{"url":"https://bugzilla.suse.com/822210","tags":["report"]},{"url":"https://bugzilla.suse.com/827811","tags":["report"]},{"url":"https://bugzilla.suse.com/828235","tags":["report"]},{"url":"https://bugzilla.suse.com/828637","tags":["report"]},{"url":"https://bugzilla.suse.com/830268","tags":["report"]},{"url":"https://bugzilla.suse.com/834594","tags":["report"]},{"url":"https://bugzilla.suse.com/836746","tags":["report"]},{"url":"https://bugzilla.suse.com/839870","tags":["report"]},{"url":"https://bugzilla.suse.com/844309","tags":["report"]},{"url":"https://bugzilla.suse.com/847227","tags":["report"]},{"url":"https://bugzilla.suse.com/854445","tags":["report"]},{"url":"https://bugzilla.suse.com/863499","tags":["report"]},{"url":"https://bugzilla.suse.com/864081","tags":["report"]},{"url":"https://bugzilla.suse.com/872832","tags":["report"]},{"url":"https://bugzilla.suse.com/882028","tags":["report"]},{"url":"https://bugzilla.suse.com/882600","tags":["report"]},{"url":"https://bugzilla.suse.com/883217","tags":["report"]},{"url":"https://bugzilla.suse.com/886416","tags":["report"]},{"url":"https://bugzilla.suse.com/887022","tags":["report"]},{"url":"https://bugzilla.suse.com/888347","tags":["report"]},{"url":"https://bugzilla.suse.com/891843","tags":["report"]},{"url":"https://bugzilla.suse.com/892065","tags":["report"]},{"url":"https://bugzilla.suse.com/892073","tags":["report"]},{"url":"https://bugzilla.suse.com/894553","tags":["report"]},{"url":"https://bugzilla.suse.com/894556","tags":["report"]},{"url":"https://bugzilla.suse.com/903288","tags":["report"]},{"url":"https://bugzilla.suse.com/904461","tags":["report"]},{"url":"https://bugzilla.suse.com/906371","tags":["report"]},{"url":"https://bugzilla.suse.com/909053","tags":["report"]},{"url":"https://bugzilla.suse.com/913646","tags":["report"]},{"url":"https://bugzilla.suse.com/915526","tags":["report"]},{"url":"https://bugzilla.suse.com/916222","tags":["report"]},{"url":"https://bugzilla.suse.com/917072","tags":["report"]},{"url":"https://bugzilla.suse.com/919678","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1472","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150253-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150439-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0475","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2306-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-4357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4043","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5417","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0475","description":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.","status":"published","published":"2014-07-29T14:00:00Z","modified":"2024-08-06T09:20:17.952Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0510","description":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.","status":"published","published":"2014-07-29T14:00:00Z","modified":"2024-08-06T09:20:17Z","updated_at":"2026-11-03T01:57:21.099925Z"}],"ghsa":[{"id":"GHSA-5rvh-fh5r-rhfv","title":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20...","description":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.","status":"published","published":"2022-05-17T03:46:13Z","modified":"2023-01-27T05:08:37Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:43:19.500885Z"}],"nvd":[{"id":"CVE-2014-0475","description":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.","status":"published","published":"2014-07-29T14:55:05.077Z","modified":"2026-06-17T00:03:06.72Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"CVE-2014-0475","description":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.","status":"published","published":"2014-07-29T14:55:05Z","modified":"2026-04-16T06:21:58.513653606Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0475","description":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.","status":"published","published":"2014-07-29T14:55:05.077Z","modified":"2026-10-23T15:47:32.378036079Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DLA-43-1","title":"eglibc - security update","status":"published","published":"2014-09-02T00:00:00Z","modified":"2026-03-09T02:09:00.111518Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-2976-1","title":"eglibc - security update","status":"published","published":"2014-07-10T00:00:00Z","modified":"2026-03-09T01:23:30.869936Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0314","title":"Updated glibc packages fix security issues","description":"Stephane Chazelas discovered that directory traversal issue in locale\nhandling in glibc.  glibc accepts relative paths with \"..\" components\nin the LC_* and LANG variables.  Together with typical OpenSSH\nconfigurations (with suitable AcceptEnv settings in sshd_config), this\ncould conceivably be used to bypass ForceCommand restrictions (or\nrestricted shells), assuming the attacker has sufficient level of\naccess to a file system location on the host to create crafted locale\ndefinitions there. (CVE-2014-0475)\n\nDavid Reid, Glyph Lefkowitz, and Alex Gaynor discovered a bug where\nposix_spawn_file_actions_addopen fails to copy the path argument (glibc\nbz #17048) which can, in conjunction with many common memory management\ntechniques from an application, lead to a use after free, or other\nvulnerabilities. (CVE-2014-4043)\n\nThis update also fixes the following issues:\nx86: Disable x87 inline functions for SSE2 math (glibc bz #16510)\nmalloc: Fix race in free() of fastbin chunk (glibc bz #15073)\n","status":"published","published":"2014-08-05T20:08:48Z","modified":"2026-04-16T06:24:15.734252473Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10154-1","title":"glibc-2.24-2.3 on GA media","description":"These are all security issues fixed in the glibc-2.24-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:26.960082Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:1110","title":"Red Hat Security Advisory: glibc security update","status":"published","published":"2024-09-15T21:56:04Z","modified":"2026-06-28T10:11:13Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-RU-2015:0794-1","title":"Security update for glibc","description":"\nThis glibc update fixes a critical privilege escalation problem and two \nnon-security issues:\n\n    * bnc#892073: An off-by-one error leading to a heap-based buffer\n      overflow was found in __gconv_translit_find(). An exploit that\n      targets the problem is publicly available. (CVE-2014-5119)\n    * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.\n    * bnc#888347: printf-multibyte-format.patch: Don't parse %s format\n      argument as multi-byte string.\n\nSecurity Issues:\n\n    * CVE-2014-5119\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\u003e\n\n","status":"published","published":"2014-08-29T01:15:58Z","modified":"2026-02-04T04:36:32.287726Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0253-1","title":"Security update for glibc","description":"\nThis glibc update fixes a critical privilege escalation problem and two \nnon-security issues:\n\n    * bnc#892073: An off-by-one error leading to a heap-based buffer\n      overflow was found in __gconv_translit_find(). An exploit that\n      targets the problem is publicly available. (CVE-2014-5119)\n    * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.\n    * bnc#888347: printf-multibyte-format.patch: Don't parse %s format\n      argument as multi-byte string.\n\nSecurity Issues:\n\n    * CVE-2014-5119\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\u003e\n\n","status":"published","published":"2014-08-29T01:15:58Z","modified":"2026-02-04T02:39:46.246573Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0439-1","title":"Security update for glibc","description":"\nThis glibc update fixes a critical privilege escalation problem and two \nnon-security issues:\n\n    * bnc#892073: An off-by-one error leading to a heap-based buffer\n      overflow was found in __gconv_translit_find(). An exploit that\n      targets the problem is publicly available. (CVE-2014-5119)\n    * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.\n    * bnc#888347: printf-multibyte-format.patch: Don't parse %s format\n      argument as multi-byte string.\n\nSecurity Issues:\n\n    * CVE-2014-5119\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\u003e\n\n","status":"published","published":"2014-08-29T01:15:58Z","modified":"2026-02-04T03:13:26.319151Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-0475","description":"Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.","status":"published","published":"2014-07-29T00:00:00Z","modified":"2026-04-22T09:29:54.894654Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2306-1","title":"eglibc vulnerabilities","description":"Maksymilian Arciemowicz discovered that the GNU C Library incorrectly\nhandled the getaddrinfo() function. An attacker could use this issue to\ncause a denial of service. This issue only affected Ubuntu 10.04 LTS.\n(CVE-2013-4357)\n\nIt was discovered that the GNU C Library incorrectly handled the\ngetaddrinfo() function. An attacker could use this issue to cause a denial\nof service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS.\n(CVE-2013-4458)\n\nStephane Chazelas discovered that the GNU C Library incorrectly handled\nlocale environment variables. An attacker could use this issue to possibly\nbypass certain restrictions such as the ForceCommand restrictions in\nOpenSSH. (CVE-2014-0475)\n\nDavid Reid, Glyph Lefkowitz, and Alex Gaynor discovered that the GNU C\nLibrary incorrectly handled posix_spawn_file_actions_addopen() path\narguments. An attacker could use this issue to cause a denial of service.\n(CVE-2014-4043)\n","status":"published","published":"2014-08-04T15:37:16Z","modified":"2026-04-22T08:54:00.389695Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}