{"id":"CVE-2014-7817","aliases":["DEBIAN-CVE-2014-7817","DLA-97-1","DSA-3142-1","EUVD-2014-7685","GHSA-47cv-pfmg-555j","MGASA-2014-0496","RHSA-2014:2023","RHSA-2015:0016","SUSE-RU-2015:0794-1","SUSE-SU-2015:0253-1","SUSE-SU-2015:0439-1","SUSE-SU-2015:0526-1","SUSE-SU-2015:0551-1","UBUNTU-CVE-2014-7817","USN-2432-1","openSUSE-SU-2024:10154-1"],"status":"published","title":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag,...","description":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing \"$((`...`))\".","severity":{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00578,"percentile":0.47849,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-09-13T15:23:14Z","modified":"2026-10-23T15:47:24Z","fixes":[{"ecosystem":"Debian:12","package":"glibc","fixed_in":["2.19-14"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glibc","fixed_in":["2.19-14"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.19-14"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"glibc","fixed_in":["2.17-7.6.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"glibc","fixed_in":["2.18-9.5.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-common","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo-common","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-devel","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-headers","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-utils","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"nscd","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-static","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-common","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo-common","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-devel","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-headers","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-utils","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nscd","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-static","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-common","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo-common","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-devel","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-headers","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-utils","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"nscd","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-static","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-common","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo-common","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-devel","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-headers","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-utils","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nscd","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-static","fixed_in":["0:2.17-55.el7_0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","fixed_in":["2.19-0ubuntu6.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-14"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-14"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-14"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-4+deb6u2"}]}],"versions":["2.11.2-10","2.11.2-10+m68k.1","2.11.2-11","2.11.2-11+m68k.1","2.11.2-12","2.11.2-13","2.11.3-1","2.11.3-2","2.11.3-3","2.11.3-4"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-38+deb7u7"}]}],"versions":["2.13-38","2.13-38+deb7u1","2.13-38+deb7u2","2.13-38+deb7u3","2.13-38+deb7u4","2.13-38+deb7u5","2.13-38+deb7u6"],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-7.6.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-9.5.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17-55.el7_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-1.149.el6_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-20.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-20.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-20.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-20.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.4"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19-0ubuntu6.4"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-2.3"}]}],"bundled":31}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"glibc"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://seclists.org/oss-sec/2014/q4/730","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://linux.oracle.com/errata/ELSA-2015-0016.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2432-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://sourceware.org/ml/libc-alpha/2014-11/msg00519.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-2023.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=a39208bd7fb76c1b01c127b4c61f9bfd915bfe7c","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201602-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/71216","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/62100","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/98852","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://secunia.com/advisories/62146","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=17625","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://linux.oracle.com/errata/ELSA-2015-0092.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3142","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7817","tags":["advisory"]},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=a39208bd7fb76c1b01c127b4c61f9bfd915bfe7c"},{"url":"https://access.redhat.com/errata/RHSA-2014:2023","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0016","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7817","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1157689","tags":["report"]},{"url":"https://github.com/advisories/GHSA-47cv-pfmg-555j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-7817","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0496.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14651","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170187","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_2023.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7817","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1135841","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0016.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-6040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6040","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150794-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/691365","tags":["report"]},{"url":"https://bugzilla.suse.com/779320","tags":["report"]},{"url":"https://bugzilla.suse.com/791928","tags":["report"]},{"url":"https://bugzilla.suse.com/801246","tags":["report"]},{"url":"https://bugzilla.suse.com/811979","tags":["report"]},{"url":"https://bugzilla.suse.com/813121","tags":["report"]},{"url":"https://bugzilla.suse.com/819347","tags":["report"]},{"url":"https://bugzilla.suse.com/822210","tags":["report"]},{"url":"https://bugzilla.suse.com/827811","tags":["report"]},{"url":"https://bugzilla.suse.com/828235","tags":["report"]},{"url":"https://bugzilla.suse.com/828637","tags":["report"]},{"url":"https://bugzilla.suse.com/830268","tags":["report"]},{"url":"https://bugzilla.suse.com/834594","tags":["report"]},{"url":"https://bugzilla.suse.com/836746","tags":["report"]},{"url":"https://bugzilla.suse.com/839870","tags":["report"]},{"url":"https://bugzilla.suse.com/844309","tags":["report"]},{"url":"https://bugzilla.suse.com/847227","tags":["report"]},{"url":"https://bugzilla.suse.com/854445","tags":["report"]},{"url":"https://bugzilla.suse.com/863499","tags":["report"]},{"url":"https://bugzilla.suse.com/864081","tags":["report"]},{"url":"https://bugzilla.suse.com/872832","tags":["report"]},{"url":"https://bugzilla.suse.com/882028","tags":["report"]},{"url":"https://bugzilla.suse.com/882600","tags":["report"]},{"url":"https://bugzilla.suse.com/883217","tags":["report"]},{"url":"https://bugzilla.suse.com/886416","tags":["report"]},{"url":"https://bugzilla.suse.com/887022","tags":["report"]},{"url":"https://bugzilla.suse.com/888347","tags":["report"]},{"url":"https://bugzilla.suse.com/891843","tags":["report"]},{"url":"https://bugzilla.suse.com/892065","tags":["report"]},{"url":"https://bugzilla.suse.com/892073","tags":["report"]},{"url":"https://bugzilla.suse.com/894553","tags":["report"]},{"url":"https://bugzilla.suse.com/894556","tags":["report"]},{"url":"https://bugzilla.suse.com/903288","tags":["report"]},{"url":"https://bugzilla.suse.com/904461","tags":["report"]},{"url":"https://bugzilla.suse.com/906371","tags":["report"]},{"url":"https://bugzilla.suse.com/909053","tags":["report"]},{"url":"https://bugzilla.suse.com/913646","tags":["report"]},{"url":"https://bugzilla.suse.com/915526","tags":["report"]},{"url":"https://bugzilla.suse.com/916222","tags":["report"]},{"url":"https://bugzilla.suse.com/917072","tags":["report"]},{"url":"https://bugzilla.suse.com/919678","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1472","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150253-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150439-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150526-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/905313","tags":["report"]},{"url":"https://bugzilla.suse.com/910599","tags":["report"]},{"url":"https://bugzilla.suse.com/915985","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150551-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/684534","tags":["report"]},{"url":"https://bugzilla.suse.com/741345","tags":["report"]},{"url":"https://bugzilla.suse.com/743689","tags":["report"]},{"url":"https://bugzilla.suse.com/744996","tags":["report"]},{"url":"https://bugzilla.suse.com/745658","tags":["report"]},{"url":"https://bugzilla.suse.com/746824","tags":["report"]},{"url":"https://bugzilla.suse.com/747768","tags":["report"]},{"url":"https://bugzilla.suse.com/750741","tags":["report"]},{"url":"https://bugzilla.suse.com/760795","tags":["report"]},{"url":"https://bugzilla.suse.com/763512","tags":["report"]},{"url":"https://bugzilla.suse.com/767266","tags":["report"]},{"url":"https://bugzilla.suse.com/770891","tags":["report"]},{"url":"https://bugzilla.suse.com/775690","tags":["report"]},{"url":"https://bugzilla.suse.com/777233","tags":["report"]},{"url":"https://bugzilla.suse.com/783060","tags":["report"]},{"url":"https://bugzilla.suse.com/785041","tags":["report"]},{"url":"https://bugzilla.suse.com/793146","tags":["report"]},{"url":"https://bugzilla.suse.com/795129","tags":["report"]},{"url":"https://bugzilla.suse.com/818628","tags":["report"]},{"url":"https://bugzilla.suse.com/918233","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3480","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-7817","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2432-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2012-6656","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-6040","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5417","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-7817","description":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing \"$((`...`))\".","status":"published","published":"2014-11-24T15:00:00Z","modified":"2024-08-06T13:03:26.878Z","updated_at":"2026-11-02T14:33:46.955592Z"}],"euvd":[{"id":"EUVD-2014-7685","description":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing \"$((`...`))\".","status":"published","published":"2014-11-24T15:00:00Z","modified":"2024-08-06T13:03:26Z","updated_at":"2026-11-03T01:56:54.204649Z"}],"ghsa":[{"id":"GHSA-47cv-pfmg-555j","title":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag,...","description":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing \"$((`...`))\".","status":"published","published":"2022-05-14T02:05:30Z","modified":"2023-02-10T05:06:47Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:54:02.847747Z"}],"nvd":[{"id":"CVE-2014-7817","description":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing \"$((`...`))\".","status":"published","published":"2014-11-24T15:59:01.637Z","modified":"2026-06-17T00:15:44.85Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-7817","description":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing \"$((`...`))\".","status":"published","published":"2014-11-24T15:59:01Z","modified":"2026-04-16T06:16:02.346446138Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-7817","description":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing \"$((`...`))\".","status":"published","published":"2014-11-24T15:59:01.637Z","modified":"2026-10-23T15:47:24.934160029Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-97-1","title":"eglibc - security update","status":"published","published":"2014-11-29T00:00:00Z","modified":"2026-03-09T01:01:19.85043Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3142-1","title":"eglibc - security update","status":"published","published":"2015-01-27T00:00:00Z","modified":"2026-03-09T01:20:44.050715Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0496","title":"Updated glibc packages fix CVE-2014-7817","description":"The function wordexp() fails to properly handle the WRDE_NOCMD\nflag when processing arithmetic inputs in the form of \"$((... ``))\"\nwhere \"...\" can be anything valid. The backticks in the arithmetic\nepxression are evaluated by in a shell even if WRDE_NOCMD forbade\ncommand substitution. This allows an attacker to attempt to pass\ndangerous commands via constructs of the above form, and bypass\nthe WRDE_NOCMD flag. This update fixes the issue (CVE-2014-7817).\n","status":"published","published":"2014-11-26T17:29:06Z","modified":"2026-04-16T06:25:20.713034829Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10154-1","title":"glibc-2.24-2.3 on GA media","description":"These are all security issues fixed in the glibc-2.24-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:26.960082Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:2023","title":"Red Hat Security Advisory: glibc security and bug fix update","status":"published","published":"2024-09-15T22:14:09Z","modified":"2026-06-26T12:21:47.582084066Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2015:0016","title":"Red Hat Security Advisory: glibc security and bug fix update","status":"published","published":"2024-09-15T22:14:14Z","modified":"2026-06-26T12:21:47.900385241Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-RU-2015:0794-1","title":"Security update for glibc","description":"\nThis glibc update fixes a critical privilege escalation problem and two \nnon-security issues:\n\n    * bnc#892073: An off-by-one error leading to a heap-based buffer\n      overflow was found in __gconv_translit_find(). An exploit that\n      targets the problem is publicly available. (CVE-2014-5119)\n    * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.\n    * bnc#888347: printf-multibyte-format.patch: Don't parse %s format\n      argument as multi-byte string.\n\nSecurity Issues:\n\n    * CVE-2014-5119\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\u003e\n\n","status":"published","published":"2014-08-29T01:15:58Z","modified":"2026-02-04T04:36:32.287726Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0253-1","title":"Security update for glibc","description":"\nThis glibc update fixes a critical privilege escalation problem and two \nnon-security issues:\n\n    * bnc#892073: An off-by-one error leading to a heap-based buffer\n      overflow was found in __gconv_translit_find(). An exploit that\n      targets the problem is publicly available. (CVE-2014-5119)\n    * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.\n    * bnc#888347: printf-multibyte-format.patch: Don't parse %s format\n      argument as multi-byte string.\n\nSecurity Issues:\n\n    * CVE-2014-5119\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\u003e\n\n","status":"published","published":"2014-08-29T01:15:58Z","modified":"2026-02-04T02:39:46.246573Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0439-1","title":"Security update for glibc","description":"\nThis glibc update fixes a critical privilege escalation problem and two \nnon-security issues:\n\n    * bnc#892073: An off-by-one error leading to a heap-based buffer\n      overflow was found in __gconv_translit_find(). An exploit that\n      targets the problem is publicly available. (CVE-2014-5119)\n    * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv.\n    * bnc#888347: printf-multibyte-format.patch: Don't parse %s format\n      argument as multi-byte string.\n\nSecurity Issues:\n\n    * CVE-2014-5119\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119\u003e\n\n","status":"published","published":"2014-08-29T01:15:58Z","modified":"2026-02-04T03:13:26.319151Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0526-1","title":"Security update for glibc","description":"glibc has been updated to fix four security issues.\n\nThese security issues were fixed:\n- CVE-2014-7817: The wordexp function in GNU C Library (aka glibc) 2.21 did not enforce the WRDE_NOCMD flag, which allowed context-dependent attackers to execute arbitrary commands, as demonstrated by input containing '$((`...`))' (bnc#906371).\n- CVE-2015-1472: Heap buffer overflow in glibc swscanf (bnc#916222).\n- CVE-2014-9402: Denial of service in getnetbyname function (bnc#910599).\n- CVE-2013-7423: Getaddrinfo() writes DNS queries to random file descriptors under high load (bnc#915526).\n\nThese non-security issues were fixed:\n- Fix infinite loop in check_pf (bsc#909053)\n- Restore warning about execution permission, it is still needed for noexec mounts (bsc#915985).\n- Don't touch user-controlled stdio locks in forked child (bsc#864081)\n- Don't use gcc extensions for non-gcc compilers (bsc#905313)\n  ","status":"published","published":"2015-03-06T15:57:36Z","modified":"2026-02-04T02:56:49.505891Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0551-1","title":"Security update for glibc","description":"\nThis update for glibc contains the following fixes:\n\n    * Fix integer overflows in malloc (CVE-2013-4332, bnc#839870)\n    * Fix buffer overflow in glob (bnc#691365)\n    * Fix buffer overflow in strcoll (CVE-2012-4412, bnc#779320)\n    * Update mount flags in \u003csys/mount.h\u003e (bnc#791928)\n    * Fix buffer overrun in regexp matcher (CVE-2013-0242, bnc#801246)\n    * Fix memory leaks in dlopen (bnc#811979)\n    * Fix stack overflow in getaddrinfo with many results (CVE-2013-1914,\n      bnc#813121)\n    * Fix check for XEN build in glibc_post_upgrade that causes missing\n      init re-exec (bnc#818628)\n    * Don't raise UNDERFLOW in tan/tanf for small but normal argument\n      (bnc#819347)\n    * Properly cross page boundary in SSE4.2 implementation of strcmp\n      (bnc#822210)\n    * Fix robust mutex handling after fork (bnc#827811)\n    * Fix missing character in IBM-943 charset (bnc#828235)\n    * Fix use of alloca in gaih_inet (bnc#828637)\n    * Initialize pointer guard also in static executables (CVE-2013-4788,\n      bnc#830268)\n    * Fix readdir_r with long file names (CVE-2013-4237, bnc#834594).\n\nSecurity Issues:\n\n    * CVE-2012-4412\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412\u003e\n    * CVE-2013-0242\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242\u003e\n    * CVE-2013-1914\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1914\u003e\n    * CVE-2013-4237\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237\u003e\n    * CVE-2013-4332\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332\u003e\n    * CVE-2013-4788\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4788\u003e\n\n","status":"published","published":"2013-09-13T15:23:14Z","modified":"2026-02-04T03:53:46.201019Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-7817","description":"The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing \"$((`...`))\".","status":"published","published":"2014-11-24T00:00:00Z","modified":"2026-04-22T09:49:22.499161Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2432-1","title":"eglibc, glibc vulnerabilities","description":"Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled\ncertain multibyte characters when using the iconv function. An attacker\ncould possibly use this issue to cause applications to crash, resulting in\na denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu\n12.04 LTS. (CVE-2012-6656)\n\nAdhemerval Zanella Netto discovered that the GNU C Library incorrectly\nhandled certain multibyte characters when using the iconv function. An\nattacker could possibly use this issue to cause applications to crash,\nresulting in a denial of service. (CVE-2014-6040)\n\nTim Waugh discovered that the GNU C Library incorrectly enforced the\nWRDE_NOCMD flag when handling the wordexp function. An attacker could\npossibly use this issue to execute arbitrary commands. (CVE-2014-7817)\n","status":"published","published":"2014-12-03T18:26:07Z","modified":"2026-04-22T09:03:52.882688Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}